CVE-2026-115281: Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute

Q: Who can exploit this vulnerability?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. Unauthenticated visitors are not identified as able to exploit it by the available information.

Q: Which plugin versions are affected and what version fixes it?

WPZOOM Recipe Card Blocks Lite versions 3.5.0 through 3.6.3 are affected. Version 3.6.4 is identified as the first version that is not affected.

Q: What input is vulnerable?

The vulnerable input is the recipeId attribute used by a block or shortcode. The plugin concatenates this attribute into SQL queries without sanitizing and casting it.

Published Oct 28, 2026

Updated

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

Affected Software

1 affected component

WPZOOM Recipe Card Blocks Lite>=3.5.0<=3.6.3

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. Unauthenticated visitors are not identified as able to exploit it by the available information.

Which plugin versions are affected and what version fixes it?

WPZOOM Recipe Card Blocks Lite versions 3.5.0 through 3.6.3 are affected. Version 3.6.4 is identified as the first version that is not affected.

What input is vulnerable?

The vulnerable input is the recipeId attribute used by a block or shortcode. The plugin concatenates this attribute into SQL queries without sanitizing and casting it.