What’s Vulnerable › Vulnerabilities
CVE-2026-86608: WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-09-23
- Weakness: CWE-400
Description
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
Affected products
- brechtvds WP Recipe Maker: from 9.8.0 before 10.8.2 — fixed in 10.8.2
How to fix
Upgrade to a fixed version: brechtvds WP Recipe Maker 10.8.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86608 or the next vulnerability affects your stack