What is the CVSS score of CVE-2026-24357?

CVE-2026-24357 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Brecht WP Recipe Maker are affected by CVE-2026-24357?

A missing authorization vulnerability in the WP Recipe Maker plugin (versions through 10.2.4) could allow unauthorized users to access or manipulate recipe content and settings on WordPress sites…

How to fix or mitigate CVE-2026-24357?

Within 24 hours: Audit all WordPress installations to identify WP Recipe Maker plugin presence and version. Within 7 days: Disable the plugin on all affected sites if business operations permit, or implement strict access control restrictions at the web application firewall level. Within 30 days: Monitor vendor communications for patch availability and develop a remediation plan for immediate deployment; consider alternative recipe management solutions if patching timeline is extended.

Brecht WP Recipe Maker CVE-2026-24357

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through <= 10.2.4.

AnalysisAI

Inadequate access control in WP Recipe Maker versions 10.2.4 and earlier allows authenticated users to bypass authorization checks and perform unauthorized actions. An attacker with low-level WordPress credentials could exploit this vulnerability to gain elevated privileges and modify sensitive recipe data without proper permissions.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Brecht WP Recipe Maker wp-recipe-maker. Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through <= 10.2.4.