Vulnerability · Published Sep 23, 2026 · Assigned by WPScan
CVE-2026-86601WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content
Medium 6.5
In plain English
A medium-severity injection in WP Recipe Maker from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Recipe Maker | 0 – before 10.8.2 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/ exploit, vdb-entry, technical-description