# CVE-2026-86601: WP Recipe Maker arbitrary shortcode execution in comments

Source: https://junglewise.ai/threats/cve-2026-86601-the-wp-recipe-maker-wordpress-plugin-before-10-8-2-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86601 · Severity: medium · CVSS 6.5 · Published 2026-09-23

The WP Recipe Maker WordPress plugin fails to sanitize shortcodes in user comments before processing them to generate page metadata. An unauthenticated attacker can inject arbitrary shortcodes into comments to execute code on the server and access unpublished recipe content, potentially compromising the website and exposing sensitive information.

## Quick answers

**Is CVE-2026-86601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86601 being exploited in the wild.

**How severe is CVE-2026-86601?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** WP Recipe Maker before 10.8.2.

**Is there a fix for CVE-2026-86601?** A patch was published on 2026-09-21: Fixed in version 10.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86601 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86601?** Check whether you run WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not strip shortcodes from comment content during structured metadata generation, allowing arbitrary shortcode injection. An unauthenticated attacker can post a malicious comment containing shortcodes that execute server-side code and disclose unpublished recipe data. The vulnerability affects versions before 10.8.2.

## Affected products

- WP Recipe Maker before 10.8.2

## Timeline

- 2026-09-21: disclosed
- 2026-09-23: advisory
- 2026-09-21: patched: Fixed in version 10.8.2

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/](https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/)