Is CVE-2026-1558 actively exploited?

No active exploitation of CVE-2026-1558 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1558 be exploited remotely?

Yes. CVE-2026-1558 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1558?

CVE-2026-1558 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-1558

MEDIUM

CVE-2026-1558

CWE-639Published: February 27, 2026· Updated: Feb 27, 2026

5.3

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.7th

Official Description

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

NVD Source

Technical Analysis

CVE-2026-1558 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.