CVE-2026-86602: WP Recipe Maker Information Disclosure

CVE-2026-86602 Overview

CVE-2026-86602 affects the WP Recipe Maker WordPress plugin in versions prior to 10.8.2. The plugin fails to perform a capability check in one of its AJAX actions. Any authenticated user, including low-privilege subscribers, can invoke the vulnerable action and retrieve the full contents of unpublished recipes. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Site operators who rely on draft or scheduled recipe posts to protect editorial content or embargoed material are directly affected.

Critical Impact
Authenticated users with subscriber-level access can read unpublished recipe content, bypassing WordPress editorial workflow controls.

Affected Products

WP Recipe Maker WordPress plugin versions prior to 10.8.2
WordPress sites that permit user registration at the subscriber level or above
WordPress installations exposing the plugin's AJAX endpoints to authenticated sessions

Discovery Timeline

2026-09-23 - CVE-2026-86602 published to the National Vulnerability Database
2026-09-23 - Last updated in the NVD database

Technical Details for CVE-2026-86602

Vulnerability Analysis

The vulnerability resides in one of the AJAX actions registered by the WP Recipe Maker plugin. WordPress plugins commonly register handlers using the wp_ajax_{action} hook, which is accessible to any authenticated user by default. Secure implementations enforce capability checks with current_user_can() or verify user roles before returning privileged data.

WP Recipe Maker omits this check on the affected action. An authenticated request to the endpoint returns the complete content of unpublished recipes, including drafts, pending review items, and scheduled posts. The plugin returns the recipe payload regardless of the requesting user's role.

The scope is limited to information disclosure. The vulnerability does not permit modification of recipe content, escalation to administrator privileges, or code execution on the host. Content confidentiality is the only affected security property.

Root Cause

The root cause is a missing authorization check on an AJAX handler. The plugin relies on the presence of a valid session rather than the requester's assigned capabilities. WordPress does not distinguish between subscribers and editors at the AJAX layer unless the plugin implements the check itself.

Attack Vector

Exploitation requires an authenticated WordPress account. On sites that allow open subscriber registration, this bar is trivial to clear. The attacker sends a crafted request to the vulnerable admin-ajax.php endpoint referencing an unpublished recipe identifier. The response contains the full recipe body. Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-86602

Indicators of Compromise

Unusual volumes of authenticated POST requests to wp-admin/admin-ajax.php originating from subscriber accounts
Repeated AJAX action calls referencing WP Recipe Maker handlers from a single session or IP
Access patterns targeting sequential recipe post IDs, suggesting enumeration of unpublished content

Detection Strategies

Parse WordPress access logs for AJAX requests where the authenticated user role is subscriber and the referenced action belongs to WP Recipe Maker
Correlate AJAX responses that return large payloads to low-privilege users against the site's expected role-based access patterns
Deploy Web Application Firewall (WAF) rules that alert on subscriber-issued calls to plugin AJAX actions not intended for that role

Monitoring Recommendations

Forward WordPress and web server logs to a central analytics platform for role-aware query and alerting
Audit new subscriber account creation for spikes that may precede content scraping
Track outbound response sizes on admin-ajax.php to identify anomalous data egress tied to specific accounts

How to Mitigate CVE-2026-86602

Immediate Actions Required

Upgrade the WP Recipe Maker plugin to version 10.8.2 or later on all affected WordPress sites
Review subscriber and contributor accounts created in recent weeks and remove any that appear illegitimate
Temporarily disable open user registration if the plugin cannot be updated immediately

Patch Information

The vendor addressed the missing capability check in WP Recipe Maker version 10.8.2. Details are available in the WPScan Vulnerability Report. Site administrators should update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Restrict access to wp-admin/admin-ajax.php at the WAF layer for subscriber-level accounts where feasible
Disable new user registration under Settings > General until the plugin is updated
Move sensitive draft recipes to a staging environment isolated from public authentication until patching is complete

bash

# Update WP Recipe Maker using WP-CLI
wp plugin update wp-recipe-maker --version=10.8.2

# Verify installed version
wp plugin get wp-recipe-maker --field=version

# Disable public registration until patched
wp option update users_can_register 0