CVE-2026-86602: WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview
Published Sep 23, 2026
·Updated
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.
Affected Software
1 affected component
Bootstrapped Ventures WP Recipe Maker>=10.3.0<=10.8.1
Event History
Sep 23, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only Subscriber-level access.
2
What information could be exposed?
An authenticated attacker can read the full content of unpublished recipes, including draft and private recipes.
3
Which plugin versions are affected and what version fixes it?
WP Recipe Maker versions 10.3.0 through 10.8.1 are affected. The issue is addressed in version 10.8.2.
4
What access does an attacker need?
The attacker needs a valid authenticated WordPress account. No elevated WordPress capability is required for the vulnerable AJAX action.