blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-86608

HIGH 8.2 CVSS 3.1
Published
September 23, 2026
Last modified
September 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-400
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Description

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Recipe Maker — From 9.8.0 (including) to 10.8.2 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/d7f0f9dd-4180-4210-9c48-dae67e8f5d8e/
  • nvd.nist.gov Official NVD record