CVE-2026-14305

WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.

Affected

WP Delicious

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-07-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6a2aecc7-3fbb-4d63-b1ac-4f8243ca872b/

References

• CVE Record
• NVD entry