CVE-2025-62131

The Tasty Recipes Lite WordPress plugin before version 1.1.5 suffers from a missing authorization vulnerability. The plugin fails to properly check access rights for certain functions, allowing attackers to exploit incorrectly configured access control security levels.

This issue can be exploited by an unauthenticated or low-privileged attacker sending crafted HTTP requests to perform administrative actions without proper authorization. No authentication is required to trigger the vulnerability, making it accessible to anyone with network access to the WordPress site.

Successful exploitation allows an attacker to execute actions intended for higher-privileged roles, such as modifying recipe settings or other restricted functionality. This type of vulnerability is frequently used in mass-exploit campaigns, targeting thousands of websites simultaneously [1].

The vulnerability has been addressed in version 1.1.6. Users are strongly advised to update immediately or enable auto-updates if using Patchstack. If immediate update is not possible, consult with a hosting provider or web developer for assistance [1].