Wellknown.Info

The plugin fails to verify if a post containing an embedded recipe is password protected before returning the recipe via its REST API and structured data output. This allows unauthenticated users to access the full content of recipes within password-protected posts, leading to sensitive information exposure.

Broken access control allows unauthenticated users to view posts, pages, and other content that are set to the Pending Review status, which should remain non-public.