CVE-2026-73999
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
Risk Assessment
An attacker can access private content of other users or modify data they shouldn't access. This may compromise data confidentiality and integrity.
Recommendation
Update the Cooked plugin to version 1.16.1 or later. Also, implement object-level authorization mechanisms.
Other vulnerabilities in Cooked
See all- CVE-2025-62989Medium
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
- CVE-2025-68586Medium
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS