CVE-2026-86602 — WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview

CVE-2026-86602

WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview PUBLISHED

Description (CNA)

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Recipe Maker	affected 10.3.0 before 10.8.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/46324e95-20dc-465e-90ab-14bcbf136166/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.