EUVD-2026-103391
GHSA-38jf-fw6r-5vcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account
-
DeliverySend taxonomy term request
-
ExploitBypass missing capability check
-
ExecutionRename or delete arbitrary terms
-
ImpactDestroy categories, tags and menus
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on the target WordPress site with a role as low as Contributor; the site must be running Tasty Recipes Lite prior to version 1.2.11. The plugin's taxonomy term create/rename/delete handlers omit a capability check, so any such logged-in user can manipulate terms in any taxonomy (categories, tags, navigation menus) regardless of their intended permissions. Limiting factors: exploitation is impossible without a valid low-privilege account, so sites that do not allow untrusted user registration or Contributor-level access are not practically exposed; no special non-default plugin configuration is otherwise needed. |
| Impact | This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) scores it MEDIUM, with impact limited to integrity (no confidentiality or availability loss). A key conflict exists: the vector encodes PR:H (high privileges), yet the description states exploitation is possible by a role 'as low as Contributor' - a low-privilege authenticated role. This suggests the input vector overstates the required privilege; a PR:L assessment (base ~6.5) better reflects reality, meaning the barrier to exploitation is lower than the published score implies. Publicly available exploit code exists (per WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The vulnerability requires an attacker to already hold an authenticated account on the target site, which meaningfully limits the population of exploitable scenarios to sites that permit untrusted Contributor-level registration. Net: a real but bounded broken-access-control flaw - patch in normal cycles, prioritize on multi-author sites that accept untrusted contributors. |
| Exploit ScenarioDerived | An attacker registers or obtains a Contributor-level account on a WordPress site running Tasty Recipes Lite before 1.2.11 (common on multi-author food/recipe blogs). Because the plugin fails to verify user capabilities, the attacker issues requests to create, rename, or permanently delete taxonomy terms - wiping out categories, tags, or entire navigation menus to disrupt site structure. Publicly available exploit code (WPScan) lowers the skill needed to carry this out. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
RemediationAI
Upgrade Tasty Recipes Lite to 1.2.11 or later; the vendor has released 1.2.11 as the fixed version, and the WPScan advisory at https://wpscan.com/vulnerability/fc8fc746-9ee1-4364-881f-28ff598f007c/ provides additional details. Until the update can be applied, reduce exposure by removing or restricting Contributor-and-above accounts on sites that do not require them, disabling open registration or moderating new users, and auditing categories, tags, and navigation menus for unauthorized changes. These controls carry trade-offs: restricting roles can disrupt legitimate editorial workflows, and disabling registration may affect community features. If term integrity is critical and upgrading is delayed, consider temporarily deactivating Tasty Recipes Lite until 1.2.11 can be installed. Because publicly available exploit code exists, prioritize the update on sites that permit low-privilege accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tasty Recipes Lite is a WordPress recipe plugin that manages taxonomy terms for recipe-related and standard WordPress taxonomies. The root cause is CWE-862 Missing Authorization: the handlers for creating, renaming, and deleting taxonomy terms do not perform the expected capability checks, such as current_user_can() checks for manage_categories, edit_terms, or delete_terms, before carrying out the requested action. As a result, any authenticated user who can reach the plugin's term-management functionality can manipulate terms in any taxonomy, including categories, tags, and navigation menus. The CPE entry identifies the affected package as cpe:2.3:a:unknown:tasty_recipes_lite:*:*:*:*:*:*:*:* with a wildcard version, while EUVD narrows affected releases to Tasty Recipes Lite 1.2 before 1.2.11. The independent assessment rates this as network-reachable, low complexity, and requiring only a low-privilege authenticated account, with high integrity impact and no confidentiality or availability impact.
Know when Tasty Recipes Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Description states a Contributor (low-privilege authenticated) suffices, so PR:L not PR:H; network-reachable with no user interaction, integrity-only impact (term tampering/deletion), no confidentiality or scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB