The vulnerability exists in a WordPress plugin that exposes a REST route without enforcing an authorization check. This route accepts user supplied data and stores it directly into a user's metadata field without any length or format restrictions. An attacker can therefore inject unlimited data into the metadata store, which can cause the target user’s account—including administrative accounts—to become unusable when the site attempts to load or render data associated with that user. The result is a loss of availability for the compromised accounts and potentially for the entire WordPress installation if the plugin data are relied upon during critical rendering paths.

Any WordPress site running the WP Recipe Maker plugin with a version earlier than 10.8.2 is affected. The vulnerability is not tied to any particular host configuration beyond the presence of the plugin, so any publicly accessible WordPress site that has not applied the patch is at risk.

The CVSS score of 8.2 indicates a high severity level. The EPSS score of less than 1% suggests that exploitation is currently rare, but the lack of an authorization check means that any unauthenticated user can trigger the attack. The vulnerability is not listed in CISA’s KEV catalog, so no active exploitation is known as of the data snapshot. Attacks would involve sending crafted HTTP requests to the exposed REST endpoint, which is accessible from any location on the internet. Because the payload does not have to be malicious code, the attack is simple to execute and does not require privileged access or user interaction.