---
id: "CVE-2026-115281"
kind: "vulnerability"
aliases: ["CVE-2026-115281"]
title: "Recipe Card Blocks Lite WordPress plugin: SQL injection via block attributes"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "recipe-card-blocks-lite", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-3.6.4-or-later", "plugin-not-installed"]
published_at: "2026-10-28T06:16:35+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115281", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# Recipe Card Blocks Lite WordPress plugin: SQL injection via block attributes

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize block and shortcode attributes before putting them into SQL queries. An authenticated user with Contributor access or higher can run SQL injection and read or change site database content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Recipe Card Blocks Lite plugin in the WordPress admin Plugins screen, or with `wp plugin get recipe-card-blocks-lite --field=version`
- Confirm whether any user accounts hold the Contributor role or higher

## Fix

- Update Recipe Card Blocks Lite to `3.6.4` or later

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115281

## From the sources

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_