{"id":"CVE-2026-115281","kind":"vulnerability","aliases":["CVE-2026-115281"],"related":[],"title":"Recipe Card Blocks Lite WordPress plugin: SQL injection via block attributes","description":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.","summary":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize block and shortcode attributes before putting them into SQL queries. An authenticated user with Contributor access or higher can run SQL injection and read or change site database content.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","recipe-card-blocks-lite","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-3.6.4-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Recipe Card Blocks Lite plugin in the WordPress admin Plugins screen, or with `wp plugin get recipe-card-blocks-lite --field=version`\n- Confirm whether any user accounts hold the Contributor role or higher","fix":"- Update Recipe Card Blocks Lite to `3.6.4` or later","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:20+00:00","updated_at":"2026-10-28T06:32:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update Recipe Card Blocks Lite to `3.6.4` or later","reach":"internet","title":"Recipe Card Blocks Lite WordPress plugin: SQL injection via block attributes","impact":"high","summary":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize block and shortcode attributes before putting them into SQL queries. An authenticated user with Contributor access or higher can run SQL injection and read or change site database content.","category":"package","nicknames":[],"who_cares":["wordpress","php","recipe-card-blocks-lite"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads or alters the site database via SQL injection","analyst_note":"","how_to_check":"- Check the installed version of the Recipe Card Blocks Lite plugin in the WordPress admin Plugins screen, or with `wp plugin get recipe-card-blocks-lite --field=version`\n- Confirm whether any user accounts hold the Contributor role or higher","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-3.6.4-or-later","no-contributor-accounts"],"who_is_affected":"Sites running Recipe Card Blocks Lite before 3.6.4 are exposed. The attack needs a logged-in account with Contributor access or above, so sites where only trusted editors can log in carry less risk. Sites that do not use the plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000603,"input_tokens":3312,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115281':14A,17A '-2026':13A,16A '3.6.4':34B,75C 'access':53B,99C 'allow':92C 'attack':106C 'attribut':11A,41B,85C 'authent':49B,93C 'block':3A,10A,23B,29B,38B,70C,82C 'card':2A,22B,28B,69C 'cast':80C 'chang':63B 'concaten':87C 'content':66B 'contributor':52B,97C 'contributor-level':96C 'cve':12A,15A 'databas':65B 'higher':55B 'inject':8A,59B,105C 'level':98C 'lite':4A,24B,30B,71C 'packag':18B 'perform':103C 'php':19B 'plugin':6A,32B,73C 'put':43B 'queri':47B,91C 'read':61B 'recip':1A,21B,27B,68C 'recipe-card-blocks-lit':20B 'run':57B 'sanit':37B,78C 'shortcod':40B,84C 'site':64B 'sql':7A,46B,58B,90C,104C 'user':50B,94C 'via':9A 'wordpress':5A,25B,31B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running Recipe Card Blocks Lite before 3.6.4 are exposed. The attack needs a logged-in account with Contributor access or above, so sites where only trusted editors can log in carry less risk. Sites that do not use the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115281","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}