CVE-2026-86603
WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists
MEDIUM 4.3EPSS 0.2%
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.
- Affected
- WP Recipe Maker
- CVSS v3.1 CNA
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.18% chance of exploitation in the next 30 days, 7th percentile
- Published
- 2026-09-23