CVE-2026-86602

MediumCVSS 4.3

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

6th percentile - higher than 6% of all known CVEs

Summary

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions. This allows any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

Risk Assessment

A low-privileged user can access the full content of other users' unpublished recipes. This may breach data confidentiality and facilitate further attacks.

Recommendation

Update the WP Recipe Maker plugin to version 10.8.2 or later. Ensure that AJAX actions verify user capabilities.

Other vulnerabilities in WP Recipe Maker WordPress plugin

CVE-2026-86603Medium
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions. This allows any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.

Original NVD description (English source)

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS