Is CVE-2026-86601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86601 being exploited in the wild.

How severe is CVE-2026-86601?

Medium severity, with a CVSS score of 6.5, published 23 September 2026.

Is there a fix for CVE-2026-86601?

A patch was published on 2026-09-21: Fixed in version 10.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86601 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86601?

Check whether you run WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86601: WP Recipe Maker arbitrary shortcode execution in comments

CVE-2026-86601 · Severity: medium · CVSS 6.5 · Published 2026-09-23

The WP Recipe Maker WordPress plugin fails to sanitize shortcodes in user comments before processing them to generate page metadata. An unauthenticated attacker can inject arbitrary shortcodes into comments to execute code on the server and access unpublished recipe content, potentially compromising the website and exposing sensitive information.

Quick answers

Is CVE-2026-86601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86601 being exploited in the wild.
How severe is CVE-2026-86601?: Medium severity, with a CVSS score of 6.5, published 23 September 2026.
Which products and versions are affected?: WP Recipe Maker before 10.8.2.
Is there a fix for CVE-2026-86601?: A patch was published on 2026-09-21: Fixed in version 10.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86601 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86601?: Check whether you run WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin does not strip shortcodes from comment content during structured metadata generation, allowing arbitrary shortcode injection. An unauthenticated attacker can post a malicious comment containing shortcodes that execute server-side code and disclose unpublished recipe data. The vulnerability affects versions before 10.8.2.

Affected products

WP Recipe Maker before 10.8.2

Timeline

2026-09-21: disclosed
2026-09-23: advisory
2026-09-21: patched: Fixed in version 10.8.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.