EUVD-2026-51015
GHSA-pcp3-pxw6-35hq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network-accessible AJAX endpoint with no complexity barrier justifies AV:N/AC:L/PR:N/UI:N; only limited post metadata integrity is impacted, so I:L with C:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.
AnalysisAI
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Technical ContextAI
WP Delicious is a WordPress recipe management plugin. WordPress AJAX handlers registered via the wp_ajax_nopriv_ hook are intentionally accessible to unauthenticated users; when a handler omits a capability check (e.g., current_user_can()), any site visitor can invoke it. CWE-287 (Improper Authentication) captures this root cause: the system fails to verify that the requester has the authority to perform the requested action. The two affected metadata fields - a like counter (likely stored as post meta) and an identifier list (likely a serialized array tracking session or user IDs) - are both writable without bound, meaning repeated unauthenticated calls can arbitrarily inflate the counter value and append entries to the identifier array indefinitely. Affected CPE: cpe:2.3:a:unknown:wp_delicious:*:*:*:*:*:*:*:*, all versions before 1.10.2.
RemediationAI
Update WP Delicious to version 1.10.2 or later, which introduces the missing authorization check on the affected AJAX action; this is confirmed as the vendor-released fix per the WPScan advisory at https://wpscan.com/vulnerability/6a2aecc7-3fbb-4d63-b1ac-4f8243ca872b/. If immediate patching is not possible, site administrators can deactivate the WP Delicious plugin entirely as a compensating control - this disables all plugin functionality including legitimate recipe features, so weigh the operational trade-off. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php where the action parameter matches the vulnerable handler name can mitigate exploitation without disabling the plugin, though the specific action name is not disclosed in available public data and would require inspection of the plugin source to identify precisely.
More in Wp Delicious
View allThe WP Delicious - Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to ar
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Deliciou
Missing authorization in WP Delicious WordPress plugin versions up to 1.9.5 enables unauthenticated remote attackers to
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today