CVE-2025-68586
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may modify recipes or settings, affecting content integrity.
Recommendation
Update the Cooked plugin to the latest version that includes the security fix.
Other vulnerabilities in Cooked
See all- CVE-2026-73999Medium
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
- CVE-2025-62989Medium
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
Original NVD description (English source)
Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS