CVE-2026-110026 Tasty Recipes Lite CVE debrief

Who should care

Defenders responsible for WordPress sites using the Tasty Recipes Lite plugin should assess exposure and prioritize verification and remediation. They need to verify the plugin version and user capabilities to prevent exploitation and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The Tasty Recipes Lite WordPress plugin vulnerability allows low-privileged users to modify taxonomy terms, potentially disrupting site organization and navigation.

• An attacker could add, rename, or delete taxonomy terms, potentially disrupting site navigation and content organization.
• An attacker could use this vulnerability to manipulate categories, tags, and other taxonomies, affecting site search and filtering.
• Defenders need to verify the plugin version and user capabilities to prevent exploitation.

Technical summary

The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus. This vulnerability could lead to unauthorized modifications of site content and structure, potentially disrupting site organization and navigation. The vulnerability allows low-privileged users to modify taxonomy terms, potentially disrupting site navigation and content organization.

Defensive priority

Defenders should prioritize verifying the version of the Tasty Recipes Lite plugin and restricting user capabilities to prevent unauthorized taxonomy term modifications.

Recommended defensive actions

• Verify the version of the Tasty Recipes Lite plugin and update to 1.2.11 or later
• Restrict user capabilities to prevent unauthorized taxonomy term modifications
• Monitor for suspicious taxonomy term changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources is limited. The Tasty Recipes Lite plugin vulnerability allows low-privileged users to modify taxonomy terms, potentially disrupting site organization and navigation. The CVE Program record and NVD entry provide source-provided CVE metadata and official vulnerability assessment. However, defenders need to verify the plugin version and user capabilities to prevent exploitation and review compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.