{"id":"CVE-2026-115281","title":"Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute","summary":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-89"],"product":"Recipe Card Blocks Lite","affected":["recipe_card_blocks_lite >= 3.5.0 < 3.6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T17:40:34.650448Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:03.936Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115281","references":[{"url":"https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/"}],"tags":["cve.org"],"epss":0.00297,"epssPercentile":0.22568,"ingestedAt":"2026-10-28T07:06:27.134Z","slug":"CVE-2026-115281","body":"## Overview\n\nThe Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.\n\n## Affected\n\n- `recipe_card_blocks_lite >= 3.5.0 < 3.6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230839,"id":"CVE-2026-115281","ts":1793211386746,"field":"cvss","old":null,"new":"6.8"},{"seq":230838,"id":"CVE-2026-115281","ts":1793211386746,"field":"severity","old":"none","new":"medium"}]}