CVE-2026-122060mediumCWE-200

CVE-2026-122060: medium-severity vulnerability in WP Recipe Maker

WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure

Published

Follow this CVE+ Monitor WP Recipe Maker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · WP Recipe Maker
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Recipe Maker

In the same product, most dangerous first.

CVE-2022-4468MEDIUMWP Recipe Maker < 8.6.1 - Contributor+ Stored XSSEPSS 0.6%CVE-2026-86601MEDIUMWP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment ContentEPSS 0.3%CVE-2026-86603MEDIUMWP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_listsEPSS 0.3%CVE-2026-86602MEDIUMWP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_previewEPSS 0.3%CVE-2026-86608HIGHWP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta InsertionEPSS 0.3%