The WP-Recall – Registration, Profile, Commerce & More plugin is vulnerable because the rcl_preview_post AJAX endpoint performs no capability check before executing a shortcode. This omission allows an authenticated attacker who has at least Subscriber level access to supply and run any arbitrary shortcode on the site, potentially leading to malicious code execution, data exfiltration, or defacement. The weakness is a classic Missing Authorization flaw (CWE-862).

All installations of the WP-Recall plugin for WordPress up to and including version 16.26.10 are affected. The problem exists in the master plugin bundle and all add‑on modules that expose the rcl_preview_post endpoint. Any WordPress site that has not yet upgraded past 16.26.10 is therefore at risk.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity. The EPSS score of less than 1% shows that exploitation is unlikely to be widespread, and it is not listed in the CISA KEV catalog. Attackers must first be authenticated (Subscriber or higher) and then target the rcl_preview_post AJAX route, typically by submitting a crafted request from the browser or via a script. Given these constraints, the risk is significant for sites that grant many users Subscriber privileges but is unlikely to be exploited against highly secure or low‑privilege deployments.