---
id: CVE-2026-115281
title: Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
summary: >-
  The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize
  and cast a block and shortcode attribute before concatenating it into SQL
  queries, allowing authenticated users with Contributor-level access or above
  to perform…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-89
product: Recipe Card Blocks Lite
affected:
  - recipe_card_blocks_lite >= 3.5.0 < 3.6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T17:40:34.650448Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:03.936Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115281'
references:
  - url: 'https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/'
tags:
  - cve.org
epss: 0.00297
epssPercentile: 0.22568
ingestedAt: '2026-10-28T07:06:27.134Z'
---

## Overview

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

## Affected

- `recipe_card_blocks_lite >= 3.5.0 < 3.6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.