WP Recipe Maker CVE-2026-86603

Requires an authenticated WordPress account of any role including subscriber (PR:L), so the target site must allow user registration or the attacker must otherwise obtain low-privilege credentials. Exploitation is remote and needs no user interaction (UI:N) once authenticated: the attacker simply calls the unprotected AJAX action on a site running WP Recipe Maker before version 10.8.2. Impact is limited to disclosure of other users' unpublished list IDs and titles - no content modification or service disruption.

This is a genuine but low-priority information-disclosure issue. The CVSS 4.3 (MEDIUM) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated account (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The disclosed data - IDs and titles of other users' unpublished lists - is metadata, not list contents or credentials, which correctly justifies C:L rather than C:H. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or automated exploitation; the primary limiting factor is the requirement for a valid low-privilege account (e.g., subscriber), which restricts exploitation to sites that permit user registration. No signals conflict here - the CVSS vector, CWE-200, and description all align. Overall this is a real bug worth patching on the normal cycle but not an urgent, widely-weaponized threat.

On a WP Recipe Maker site that allows open user registration, an attacker registers a subscriber-level account and invokes the vulnerable AJAX action, which performs no authorization check. The response leaks the IDs and titles of unpublished (draft) lists belonging to other users, exposing pre-release content metadata. No public exploit code was identified at time of analysis.