The WP Recipe Maker plugin for WordPress contains an authorization bypass flaw (CWE‑862) that occurs because the plugin does not verify that a user is permitted to perform certain recipe operations. This weakness allows an authenticated user with contributor-level access to change the post_author field of any administrator‑authored recipe to their own user ID and alter its post_status to draft or pending. Consequently, the attacker can take ownership of the recipe and prevent it from being published, without executing arbitrary code or requiring higher privileges.

WordPress installations running the brechtvds WP Recipe Maker plugin through version 10.8.0 are impacted. Sites with the plugin enabled must ensure they are not using the vulnerable version and that the default "recipe_use_author" setting is considered when planning updates.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is currently available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower but non‑negligible exploitation probability. Because the attacker only needs contributor‑level access and normal use of the shortcode, the risk lies primarily in confidential content loss and denial of service to recipe publishing.