CVE-2026-86603 — WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists

CVE-2026-86603

WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists PUBLISHED

Description (CNA)

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Recipe Maker	affected 0 before 10.8.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f5eedd48-91a6-4216-9e96-32dfb7a23ee4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.