CVE-2026-86608: WP Recipe Maker Auth Bypass Vulnerability

CVE-2026-86608 Overview

CVE-2026-86608 affects the WP Recipe Maker WordPress plugin in versions prior to 10.8.2. The plugin exposes a REST route without an authorization check and without bounding the amount of data written to storage. Unauthenticated attackers can write unlimited data into any user's metadata, including administrator accounts. The result is permanent account lockout because the bloated metadata prevents the affected user, including administrators, from loading. The flaw is classified as uncontrolled resource consumption [CWE-400] and is exploitable remotely over the network without user interaction.

Critical Impact

Unauthenticated remote attackers can permanently lock administrator accounts out of a WordPress site by flooding user metadata through an unprotected REST endpoint.

Affected Products

• WP Recipe Maker WordPress plugin versions prior to 10.8.2
• WordPress sites with the vulnerable plugin installed and REST API reachable
• Administrator and standard user accounts on affected installations

Discovery Timeline

• 2026-09-23 - CVE-2026-86608 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86608

Vulnerability Analysis

The vulnerability resides in a REST API route registered by the WP Recipe Maker plugin. The route lacks a permission_callback that validates the requester's identity or capability. Any unauthenticated client can therefore invoke the endpoint over the network.

The route accepts data that is persisted into the WordPress usermeta table for a targeted user. It does not enforce a maximum payload size, a per-key length limit, or a rate limit. Attackers can repeatedly write arbitrary bulk data into a specific user's metadata record.

When WordPress loads a user object, it hydrates associated metadata into memory. Excessive metadata causes the load routine to exhaust available PHP memory or exceed execution timeouts. The targeted account, including an administrator, can no longer authenticate or render pages that require its user object, producing a persistent denial of service on that identity.

Root Cause

The root cause is a missing authorization check combined with the absence of input bounding. The REST route neither authenticates callers nor caps the size of stored metadata, satisfying the conditions for uncontrolled resource consumption [CWE-400].

Attack Vector

Exploitation requires only network access to the site's REST API endpoint. Attackers issue crafted HTTP requests to the vulnerable route, targeting a known or enumerated user ID. Repeated requests inflate the target's metadata until the account becomes unusable. No credentials, privileges, or user interaction are required.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-86608

Indicators of Compromise

• Administrator or user accounts that fail to load, time out, or produce PHP memory exhaustion errors on login and profile pages
• Abnormally large row counts or meta_value sizes in the wp_usermeta table tied to specific user_id values
• Repeated unauthenticated POST or PUT requests to /wp-json/ routes associated with the WP Recipe Maker plugin
• Sudden growth in database size without a corresponding increase in content or user activity

Detection Strategies

• Query wp_usermeta for rows where LENGTH(meta_value) exceeds a defined threshold, and correlate to recent REST traffic
• Inspect web server access logs for unauthenticated requests to WP Recipe Maker REST routes with high volume from single source IPs
• Enable WordPress debug logging to capture memory limit and execution timeout errors linked to user loading

Monitoring Recommendations

• Alert on spikes in POST volume to /wp-json/wp-recipe-maker/ endpoints from unauthenticated sources
• Monitor MySQL for unusual write rates against the wp_usermeta table
• Track failed administrator logins accompanied by PHP fatal errors in application logs

How to Mitigate CVE-2026-86608

Immediate Actions Required

• Upgrade the WP Recipe Maker plugin to version 10.8.2 or later on all WordPress installations
• Audit the wp_usermeta table for oversized entries and remove malicious metadata associated with impacted accounts
• Restore administrator access by pruning bloated usermeta rows directly in the database if lockout has already occurred
• Restrict access to the WordPress REST API from untrusted networks where operationally feasible

Patch Information

The vendor addressed the issue in WP Recipe Maker version 10.8.2 by introducing authorization checks and bounding the data written to user metadata. Site owners should apply the update through the WordPress plugin manager or by deploying the patched release from the official repository. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Deactivate the WP Recipe Maker plugin until the patched version can be deployed
• Block unauthenticated requests to the plugin's REST routes at the web application firewall or reverse proxy
• Apply rate limiting to /wp-json/ endpoints to slow bulk metadata writes
• Enforce IP allow-listing on the REST API for administrative environments

# Example nginx rule blocking unauthenticated access to the vulnerable route
location ~ ^/wp-json/wp-recipe-maker/ {
    if ($http_authorization = "") {
        return 403;
    }
    limit_req zone=wpapi burst=5 nodelay;
}