CVE-2026-110026
Received Received - Intake

Unauthorized Taxonomy Term Manipulation in Tasty Recipes Lite WordPress Plugin

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: WPScan

Description
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-110026
EUVD
EUVD-2026-103391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Tasty Recipes Lite 1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tasty Recipes Lite WordPress plugin before version 1.2.11 has a vulnerability where it fails to properly check user capabilities. This allows users with the Contributor role or higher to create, rename, and permanently delete taxonomy terms across any taxonomy on the site, including categories, tags, and navigation menus.

Detection Guidance

Check the installed version of the Tasty Recipes Lite plugin. If it is between 1.2 and 1.2.10, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker with Contributor access could modify or delete important site taxonomies like categories and tags, disrupting site organization and content structure. This could lead to data loss, broken site functionality, or unauthorized changes to site content.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, potentially violating integrity and access control requirements in GDPR and HIPAA. If taxonomy terms are deleted, it may affect data classification and retrieval, leading to compliance violations.

Mitigation Strategies

Update the Tasty Recipes Lite plugin to version 1.2.11 or later immediately. This version includes the fix for the capability check issue. Disable or remove the plugin if updating is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110026. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart