SQL Injection Vulnerability in Recipe Card Blocks Lite Plugin by WordPress
CVE-2026-115281
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
What is CVE-2026-115281?
The Recipe Card Blocks Lite plugin for WordPress prior to version 3.6.4 is vulnerable to SQL injection attacks. This vulnerability arises from the plugin's failure to properly sanitize and cast a block and shortcode attribute before incorporating it into SQL queries. As a result, authenticated users with Contributor-level access or higher can exploit this vulnerability to execute unauthorized SQL commands and manipulate the database, potentially compromising the integrity of the web application. Users are encouraged to update to the latest version to mitigate risks associated with this security flaw.
Affected Version(s)
Recipe Card Blocks Lite 3.5.0 < 3.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.