CVE-2026-14305
MEDIUMWP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
Title source: cnaDescription
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.
References (1)
Core 1
Core References
Exploit exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/6a2aecc7-3fbb-4d63-b1ac-4f8243ca872b/
Scores
CVSS v3
5.3
EPSS
0.0015
EPSS Percentile
5.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-287
Status
published
Products (1)
None/WP Delicious
< 1.10.2
Published
Jul 30, 2026
Tracked Since
Jul 30, 2026