CVE-2026-115281

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

Score

CVSS 3.1 6.8 Medium

Status

Deferred - contact@wpscan.com

Published

2026-10-28

Last modified

2026-10-28

Weaknesses

CWE-89

Affected products

• Recipe Card Blocks Lite (Unknown)

References

• https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/