CVE-2026-86603
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions. This allows any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.
Risk Assessment
A user with the lowest privileges can access information about other users' unpublished content. This may breach data confidentiality and facilitate further attacks on private content.
Recommendation
Update the WP Recipe Maker plugin to version 10.8.2 or later. Verify that AJAX actions require appropriate capabilities and nonce tokens.
Other vulnerabilities in WP Recipe Maker WordPress plugin
Original NVD description (English source)
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS