WP Recipe Maker CVE-2026-86602

Requires an authenticated WordPress account of any privilege level, including subscriber (PR:L), on a site running WP Recipe Maker between 10.3.0 and before 10.8.2; the specific limiter is the vulnerable AJAX action that omits its capability check. Practical exploitability hinges on whether the target site permits open user registration - if so, an attacker self-provisions a subscriber account with no barrier; if registration is closed, the attacker must otherwise obtain a low-privilege account. No user interaction by a victim is needed (UI:N), and the payoff is bounded to reading unpublished recipe content only (no write or takeover capability).

This is a low-severity, authenticated information-disclosure issue whose signals are internally consistent and point to modest real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) correctly reflects a network-reachable but authentication-gated flaw: an attacker needs a valid low-privilege account (subscriber), and the impact is limited to confidentiality of a narrow data set (C:L, no integrity or availability effect). No EPSS score, CISA KEV entry, or public POC was provided in the intelligence set; per the precision rules this is 'no public exploit identified at time of analysis' - note that missing EPSS/KEV/POC is an absence of signal, not evidence of safety. The single meaningful limiting factor is the PR:L requirement: on sites where open user registration is enabled (common for recipe/community sites running this plugin), obtaining a subscriber account is trivial and the barrier is low; on sites without self-registration, the attacker must already hold or acquire an account. There is no data conflict - the CVSS vector, description (authenticated subscriber reading unpublished content), and CWE-200 all agree. Net: a real but low-priority patch-management item, not an emergency; prioritize by whether the affected site allows open registration and hosts sensitive/embargoed draft content.

An attacker registers (or already holds) a subscriber-level account on a WordPress site running WP Recipe Maker before 10.8.2, then calls the vulnerable AJAX action directly. Because the handler performs no capability check, it returns the full content of unpublished (draft/pending) recipes that the subscriber should not be able to see, leaking embargoed or premium content. No public exploit code is identified at time of analysis, but the attack is trivial (single authenticated AJAX request, AC:L).