---
id: CVE-2026-115282
title: >-
  Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post
  Content Disclosure
summary: >-
  The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an
  authorization check before rendering posts through its recipe print feature,
  allowing unauthenticated users to disclose the title, ID and recipe content of
  unp…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Recipe Card Blocks Lite
affected:
  - recipe_card_blocks_lite >= 2.6.4 < 3.6.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T10:54:09.954499Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:09.514Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115282'
references:
  - url: 'https://wpscan.com/vulnerability/b80a2b0f-6d9a-4532-9a8e-65f889e8077b/'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10751
ingestedAt: '2026-11-01T17:57:46.227Z'
---

## Overview

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.

## Affected

- `recipe_card_blocks_lite >= 2.6.4 < 3.6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.