CVE-2026-86601 — WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

CVE-2026-86601

WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content PUBLISHED

Description (CNA)

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Recipe Maker	affected 0 before 10.8.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.