CVE-2025-67548

The WP Delicious plugin for WordPress suffers from a Missing Authorization vulnerability in versions up to and including 1.9.1. This issue stems from incorrectly configured access control security levels, specifically in the delicious-recipes component, allowing exploitation of default access controls.

Attackers can leverage this broken access control without authentication, making it suitable for mass exploitation campaigns. The vulnerability is reported to be used in attempts to compromise thousands of websites irrespective of their size or popularity[1].

While the impact is assessed as low severity and exploitation unlikely according to the advisory, successful exploitation could allow unprivileged attackers to perform actions normally reserved for higher-privileged users. The CVSS v3 base score of 6.5 (Medium) reflects this potential.

The vulnerability is addressed in version 1.9.2 of the plugin. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to mitigate the risk[1].