Authorization Bypass in Recipe Card Blocks Lite Plugin Affects WordPress Users
CVE-2026-115282
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-115282?
The Recipe Card Blocks Lite plugin for WordPress, prior to version 3.6.4, lacks proper authorization checks when rendering posts via its recipe print feature. This flaw allows unauthorized users to access sensitive information such as titles, IDs, and content from unpublished posts including drafts, pending, private, and those protected by password. Notably, the optional 'print only published posts' feature does not mitigate the risk, as the status validation occurs on a different post than the one actually displayed.
Affected Version(s)
Recipe Card Blocks Lite 2.6.4 < 3.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.