The WP Recipe Maker WordPress plugin before version 10.8.2 contains an AJAX action, wprm_shortcode_preview, that does not enforce capability checks. Authenticated users, including subscribers, can trigger this action to retrieve the full content of unpublished recipes, resulting in a breach of confidentiality for private or draft recipe data. The weakness is a classic case of improper authorization (CWE-200).

The vulnerability affects WordPress installations running WP Recipe Maker plugin versions 10.3.0 through 10.8.1 inclusive. Any site that has not upgraded past 10.8.1 is at risk when the plugin's AJAX handler is exposed.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitative access requires only a valid authenticated session; any user with subscriber or higher role can invoke the AJAX endpoint. The lack of a capability check enables such users to read unpublished recipe content, which could be valuable to competitors or reveal proprietary information. The risk is therefore considered moderate confidentiality exposure with a low exploitation probability.