CVE-2026-115282: Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using WPZOOM Recipe Card Blocks Lite versions 2.6.4 through 3.6.3 are affected when unpublished posts contain a recipe card block. Exposed content can include drafts, pending posts, private posts, and password-protected posts.
Does an attacker need an account or permission to retrieve the content?
No. The disclosure can be exploited by unauthenticated users because the recipe print feature renders the target post without an authorization check.
Does enabling the plugin's “print only published posts” option mitigate the issue?
No. That option does not prevent disclosure because its status check is performed against a different post from the one that is ultimately rendered.
What information can be disclosed?
An attacker may obtain the unpublished post's title, ID, and recipe content.