The vulnerability originates from a missing authorization check in the wprm_search_lists AJAX action of the WP Recipe Maker plugin. Any authenticated user, including those with subscriber roles, can issue requests to this endpoint and obtain the IDs and titles of other users' unpublished recipe lists. This results in the disclosure of protected metadata (CWE-200), potentially enabling social‑engineering or further attacks based on that information.

WordPress sites that have the WP Recipe Maker plugin installed in a version earlier than 10.8.2 are affected. The vendor is listed as Unknown: WP Recipe Maker and the issue applies to all installations that have enabled the plugin without additional access restrictions.

The CVSS base score of 4.3 indicates moderate impact, while the EPSS score is less than 1%, suggesting a low probability of exploitation. This vulnerability is not catalogued in the CISA KEV list. The attack vector is remote and requires only that an attacker authenticate to the site; any subscriber role can trigger the vulnerable AJAX call, allowing on‑demand retrieval of unpublished list metadata.