CVE-2026-86608: WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated user can exploit the affected REST route; no account or authorization is required.
Which accounts can be impacted?
The route allows data to be written into any user's metadata. This includes administrator accounts, and affected accounts can be permanently prevented from loading.
Are installations running the default plugin configuration affected?
The available information identifies a REST route with no authorization check and does not state that a non-default configuration or feature enablement is required. Installations using WP Recipe Maker versions before 10.8.2 should be treated as affected.
What should be done if an affected account no longer loads?
The provided information does not describe a recovery procedure. The issue is addressed in WP Recipe Maker 10.8.2, so upgrading the plugin is the stated remediation.