CVE-2026-86603: WP Recipe Maker Information Disclosure

CVE-2026-86603 Overview

CVE-2026-86603 is an information disclosure vulnerability in the WP Recipe Maker WordPress plugin versions prior to 10.8.2. The plugin fails to perform authorization checks in one of its AJAX actions. Any authenticated user, including low-privileged subscribers, can retrieve the IDs and titles of other users' unpublished recipe lists. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated attackers with minimal privileges can enumerate unpublished content metadata belonging to other users, exposing draft titles and internal identifiers that should remain private.

Affected Products

WP Recipe Maker WordPress plugin versions prior to 10.8.2
WordPress sites with the plugin installed and user registration enabled
Multi-author WordPress environments using the plugin's list features

Discovery Timeline

2026-09-23 - CVE-2026-86603 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86603

Vulnerability Analysis

The vulnerability exists in an AJAX action handler exposed by the WP Recipe Maker plugin. The handler processes authenticated requests but omits a capability or ownership check before returning list data. As a result, a subscriber-level account can query the endpoint and receive metadata for lists owned by other users, including drafts that were never published.

WordPress plugins commonly register AJAX endpoints through wp_ajax_{action} hooks. Endpoints registered under this pattern are accessible to any authenticated user unless the callback enforces additional checks with functions such as current_user_can() or by validating post ownership. This plugin's handler processes the request without such verification.

The disclosed data is limited to list IDs and titles rather than full content. However, titles frequently contain sensitive business context, planned publication information, or internal naming conventions that support further reconnaissance.

Root Cause

The root cause is missing authorization logic in the AJAX action callback. The code path authenticates the requester through the WordPress nonce and session, then returns list objects without filtering by the requesting user's ownership or role. This is a classic broken access control pattern where authentication is conflated with authorization.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session at subscriber level or higher. The attacker submits a crafted request to the vulnerable AJAX endpoint using their own valid nonce. The server responds with list metadata belonging to other users. No user interaction from the victim is required. Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-86603

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php from a single authenticated subscriber account within a short timeframe
AJAX responses containing list metadata for post IDs the requesting user does not own
Newly registered subscriber accounts issuing AJAX calls targeting WP Recipe Maker actions shortly after registration

Detection Strategies

Review web server access logs for high-volume admin-ajax.php requests originating from low-privileged accounts
Correlate the WordPress user ID in session cookies against the ownership of resources returned in AJAX responses
Enable WordPress plugin audit logging to capture AJAX action invocations by role

Monitoring Recommendations

Alert on any subscriber-level account issuing more than a baseline threshold of AJAX requests per minute
Monitor for new user registrations followed immediately by AJAX enumeration behavior
Track HTTP response sizes from admin-ajax.php to identify bulk data retrieval anomalies

How to Mitigate CVE-2026-86603

Immediate Actions Required

Update the WP Recipe Maker plugin to version 10.8.2 or later on all WordPress installations
Audit existing subscriber accounts and remove any that are unrecognized or inactive
Review WordPress user registration settings and disable open registration if not required

Patch Information

The vendor addressed the missing authorization check in WP Recipe Maker version 10.8.2. Site administrators should apply the update through the WordPress plugin management interface or by deploying the patched release from the plugin repository. Details are documented in the WPScan Vulnerability Report.

Workarounds

Disable the WP Recipe Maker plugin until the update is applied if immediate patching is not feasible
Restrict access to /wp-admin/admin-ajax.php at the web application firewall for authenticated subscriber roles where possible
Temporarily disable new user self-registration to limit the attack surface

bash

# Configuration example: disable open registration in wp-config.php
define( 'DISALLOW_FILE_MODS', false );
# In WordPress Settings > General, uncheck "Anyone can register"
# Or via WP-CLI:
wp option update users_can_register 0