Tasty Recipes Lite
Monthly
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.