CVE-2026-86603CWE-200information-disclosure
CVE-2026-86603
Medium · published September 23, 2026
What it is
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00176 · 6.8th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2026-09-23T10:17Z
References (1)
EPSS history
Timeline