WP Recipe Maker EUVD-2026-85044

No special conditions beyond having the affected plugin installed - remote unauthenticated exploitation against default configurations of WP Recipe Maker (versions 9.8.0 up to but not including 10.8.2). The vulnerable REST route lacks any authorization check and imposes no bound on stored metadata, so PR:N/UI:N holds. The only limiting factor is that the site must run a vulnerable plugin version; there is no required user interaction, authentication, or non-default setting. Impact is amplified because the attacker can target the administrator account, but the lockout is a denial of service rather than a privilege gain or data disclosure.

This is a genuine priority for any site running the affected plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 8.2) describes a fully remote, unauthenticated, low-complexity attack with no user interaction - the easiest exploitation profile that exists. The core defect is a REST route with no authorization check that also imposes no bound on stored data, so an attacker can write unlimited data into any user's metadata and permanently lock accounts (including administrators) out of the application. The A:H (permanent account lockout / denial of service) and I:L (arbitrary metadata write) are well-justified; C:N is correct since no data is read back. No EPSS score, KEV listing, or explicit POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk here is driven by exploitability and impact, not by confirmed in-the-wild activity. A key nuance: despite the 8.2 'High'-range score, this is an availability/integrity issue, not code execution or data theft, so the real-world consequence is site disruption and admin lockout rather than full compromise. Because a vendor patch (10.8.2) is available, remediation is straightforward and should be prioritized given the trivial exploitation barrier.

An unauthenticated attacker sends crafted requests to the unprotected WP Recipe Maker REST route, targeting a known or enumerated user ID (such as the default admin, ID 1), and writes large volumes of unbounded data into that user's metadata. Because the metadata is loaded when the account is fetched, the bloated record prevents the administrator account from loading at all, effectively locking legitimate operators out of the site. No POC is referenced in the available data, but the low complexity and lack of authentication make reliable exploitation trivial once the route is known.