WP Recipe Maker Vulnerability- Missing Authorization to Authenticated SQL Injection – CVE-2024-1206 |WordPress Plugin Vulnerability Report

Plugin Name: WP Recipe Maker

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-recipe-maker
  • Software Status: Active
  • Software Author: brechtvds
  • Software Downloads: 2,598,010
  • Active Installs: 50,000
  • Last Updated: February 13, 2024
  • Patched Versions: 9.2.0
  • Affected Versions: <= 9.1.2

Vulnerability Details:

  • Name: WP Recipe Maker <= 9.1.2
  • Title: Missing Authorization to Authenticated (Subscriber+) SQL Injection
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE: CVE-2024-1206
  • CVSS Score: 8.8
  • Publicly Published: February 7, 2024
  • Researcher: Lucio Sá
  • Description: The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2. This vulnerability arises from insufficient escaping of user-supplied parameters and a lack of proper preparation in SQL queries. As a result, authenticated attackers with subscriber-level access or higher can inject additional SQL queries to extract sensitive information from the database.


The WP Recipe Maker plugin for WordPress harbors a critical SQL Injection vulnerability in versions up to and including 9.1.2. This flaw allows attackers with at least subscriber-level access to manipulate SQL queries and potentially access sensitive database information. Fortunately, this vulnerability has been addressed in the newly released version 9.2.0.

Detailed Overview:

Discovered by researcher Lucio Sá, this significant security issue within WP Recipe Maker could lead to unauthorized data exposure and manipulation. SQL Injection vulnerabilities like this can enable attackers to execute arbitrary SQL commands, compromising the integrity and confidentiality of the data stored within the WordPress site's database. The patch in version 9.2.0 rectifies this by properly sanitizing user inputs and preparing SQL queries to prevent injection, thereby safeguarding against this and similar injection tactics.

Advice for Users:

Immediate Action: Users of WP Recipe Maker should promptly upgrade to version 9.2.0 to mitigate the risks associated with this vulnerability. Check for Signs of Vulnerability: Site administrators are advised to review their databases for any unusual activity or unauthorized access, which may indicate exploitation. Alternate Plugins: While the immediate risk has been addressed, users may consider evaluating alternative recipe plugins to ensure a diverse security posture. Stay Updated: Maintaining the latest versions of all WordPress plugins is critical in protecting against known vulnerabilities. Regular updates, along with robust security practices, are essential for securing WordPress installations.


The prompt resolution of the SQL Injection vulnerability in WP Recipe Maker by the developers highlights the ongoing importance of vigilant software maintenance. By updating to version 9.2.0, users can protect their sites from this particular vulnerability and contribute to the overall security of their online presence.


In the ever-evolving digital landscape, the integrity of your WordPress website hinges not just on the content you create but also on the security of the tools you use to enhance your site's functionality. The recent discovery of a significant SQL Injection vulnerability in the WP Recipe Maker plugin, identified as CVE-2024-1206, serves as a poignant reminder of the constant vigilance required to safeguard our online realms. This plugin, beloved by food bloggers and culinary enthusiasts for its recipe management features, has been revealed to have a critical flaw that could potentially compromise the security and integrity of countless websites.

WP Recipe Maker: A Culinary Cornerstone

WP Recipe Maker, developed by brechtvds, stands as a cornerstone for culinary content creators on WordPress, boasting over 2.5 million downloads and 50,000 active installations. Its utility in seamlessly managing and displaying recipes has made it an indispensable tool for many. However, the security of such plugins is paramount, as vulnerabilities can turn them from helpful tools into potential gateways for malicious exploits.

The Crux of the Vulnerability: CVE-2024-1206

The vulnerability in question, CVE-2024-1206, stems from insufficient input sanitization and inadequate SQL query preparation, allowing attackers with subscriber-level access to execute unauthorized SQL queries. This can lead to the extraction of sensitive data from the website's database, posing severe risks to site integrity and user privacy. With a CVSS score of 8.8, the severity of this vulnerability is undeniable, emphasizing the need for immediate action.

Potential Risks and Impacts

The implications of such a vulnerability are far-reaching. Unauthorized access to sensitive data can lead to privacy breaches, loss of user trust, and potentially severe legal repercussions. For small business owners, where the website often serves as the primary interface with customers, such breaches can tarnish reputations and erode the hard-earned trust of their clientele.

Remediation: Securing Your Culinary Creations

In response to this vulnerability, the developers of WP Recipe Maker have released a patched version, 9.2.0, effectively closing the gap that allowed for SQL Injection. Users of the plugin are urged to update to this latest version immediately to protect their sites from potential exploitation. Regularly updating plugins, themes, and the WordPress core is not just recommended; it is essential for maintaining the security of your site.

Learning from the Past

This is not the first time vulnerabilities have been discovered in WP Recipe Maker, with 8 previous issues reported since December 19, 2022. Each of these instances serves as a learning opportunity, highlighting the importance of continuous monitoring and updating of all software components of a WordPress site.

The Imperative of Proactive Security Measures

For small business owners juggling various responsibilities, keeping abreast of every security update and patch can seem daunting. However, the digital security of your business is not a responsibility that can be deferred. Leveraging managed WordPress hosting services, employing security plugins, and conducting regular site audits can mitigate the risks and help maintain the sanctity of your digital presence.

In conclusion, the discovery of CVE-2024-1206 within WP Recipe Maker underscores a critical aspect of digital stewardship - the need for constant vigilance and timely updates. As we continue to rely on plugins to enhance our WordPress sites, understanding and addressing potential vulnerabilities becomes paramount. For small business owners, this vigilance is not just about protecting data; it's about safeguarding your reputation, your brand, and the trust of your customers. In the digital age, being proactive about security is not just good practice; it's a cornerstone of your online presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP Recipe Maker Vulnerability- Missing Authorization to Authenticated SQL Injection – CVE-2024-1206 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment