An unauthenticated vulnerability in the WP Recipe Maker plugin allows attackers to corrupt user metadata and render accounts unusable, including those with administrative privileges.

The plugin fails to perform authorization checks within a specific REST API route. This allows an unauthenticated attacker to inject arbitrary data into user metadata fields, leading to uncontrolled resource consumption and account lockout.

This vulnerability carries a CVSS score of 8.2, reflecting its high severity due to the lack of required authentication and the potential for significant disruption. By targeting administrative accounts, an attacker could effectively lock out site owners, leading to a complete loss of administrative control, site downtime, and a requirement for manual database intervention to restore access.

Immediate Action: Update the WP Recipe Maker plugin to version 10.8.2 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests directed at REST API endpoints, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block unauthorized requests to the vulnerable REST API endpoints until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

The risk posed by this vulnerability is significant, as it allows for trivial, unauthenticated denial-of-service attacks against critical site infrastructure. Organizations using WP Recipe Maker must prioritize updating to version 10.8.2 to close this security gap and ensure the integrity of user metadata and administrative access.