Recipe Card Blocks CVE-2026-115281

Requires an authenticated WordPress account with at least Contributor role on a site running Recipe Card Blocks Lite version 3.5.0 up to but not including 3.6.4; the attacker must be able to supply a value to the vulnerable recipe block or shortcode attribute that the plugin concatenates into a SQL query without sanitization or casting. Limiting factors: exploitation is gated by holding a valid Contributor-or-higher account, so sites that do not allow untrusted users to register at or above Contributor level, or that have upgraded to 3.6.4, are not exploitable; the official vector's PR:H suggests an even higher privilege barrier than the description's 'Contributor' wording, which should be confirmed with the vendor.

This is a legitimate but moderate-priority vulnerability, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) describes network-reachable, low-complexity SQL injection that requires an authenticated account and yields high confidentiality impact with a changed scope (the injection reaches the backend database beyond the plugin's own boundary). All exploitation signals point to constrained, not widespread, risk: EPSS is only 0.18% (8th percentile), there is no CISA KEV listing, and no verified public exploit code. The vendor priority label is 'this_month', consistent with a patch-on-normal-cycle item rather than act_now/emergency. One signal conflicts with the description: the official vector sets PR:H, yet the description states exploitation needs only 'Contributor-level access or above', which in WordPress is a low-privilege role - this normally maps to PR:L, meaning the real authentication barrier may be lower than PR:H implies and the practical severity slightly higher than the 6.8 suggests on sites that permit contributor registration. Impact is scoped to confidentiality (C:H, I:N, A:N): the flaw enables reading database contents (e.g., user records, password hashes, secrets), not direct data modification or denial of service, per the assigned metrics.

An attacker who holds or obtains a Contributor-level WordPress account on a site running Recipe Card Blocks Lite 3.5.0-3.6.3 inserts a crafted value into a vulnerable recipe block or shortcode attribute, which the plugin concatenates unsanitized into a SQL query. By tuning the injected attribute the attacker extracts sensitive database contents such as user credentials and secrets. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once a qualifying account is available.