What is the CVSS score of EUVD-2026-39668?

EUVD-2026-39668 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Zip Recipes are affected by EUVD-2026-39668?

The Zip Recipes WordPress plugin (versions 8.2.7 and earlier) contains a SQL injection vulnerability allowing authenticated Contributor-level users to access your entire WordPress database, creating…

How to fix or mitigate EUVD-2026-39668?

Within 24 hours: Inventory all WordPress instances running Zip Recipes plugin and identify affected versions; restrict Contributor role permissions or disable the plugin entirely. Within 7 days: Deactivate and uninstall Zip Recipes 8.2.7 or earlier from all systems; audit WordPress database logs for suspicious queries or unauthorized access patterns. Within 30 days: Evaluate alternative recipe management solutions; implement Web Application Firewall rules to detect SQL injection attempts; establish monitoring for Patchstack and WordPress plugin repository patch releases.

Zip Recipes EUVD-2026-39668

| CVE-2026-57663 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-2qmw-f5m7-5vh7

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable SQLi needing only a Contributor login (PR:L), no interaction; database read drives C:H and shared-DB reach gives S:C, with no confirmed integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:45 vuln.today

DescriptionCVE.org

Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

AnalysisAI

SQL injection in the Zip Recipes (Recipe Maker For Your Food Blog) WordPress plugin lets an authenticated Contributor-level user inject arbitrary SQL through the plugin in versions 8.2.7 and earlier, exposing the full WordPress database. Reported by Patchstack, the flaw carries a CVSS 3.1 score of 8.5 with a scope change (S:C) reflecting access beyond the plugin's own data. No public exploit identified at time of analysis, and the issue is not in CISA KEV.

Technical ContextAI

The affected component is the Zip Recipes plugin for WordPress, which lets food bloggers build and embed recipe cards. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reachable by Contributor-role accounts is concatenated into a SQL query without proper parameterization or sanitization, so an attacker can break out of the intended query and run their own SQL against the WordPress MySQL/MariaDB backend. Because WordPress shares a single database across the whole site, an injection in any plugin can read data belonging to core and other plugins - which is why the CVSS scope is marked Changed (S:C). No CPE strings were supplied in the input; affected versions are known only from the advisory text (<= 8.2.7).

RemediationAI

Update the Zip Recipes plugin to the latest available release above 8.2.7; an exact fixed version number was not included in the provided data, so confirm the patched version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/zip-recipes/vulnerability/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-2-7-sql-injection-vulnerability) and the plugin's WordPress.org changelog before deploying. If you cannot patch immediately, reduce the attack surface by removing or downgrading untrusted Contributor accounts and disabling open user registration (Settings > General > 'Anyone can register'), since exploitation requires at least a Contributor login - the trade-off is that legitimate guest authors lose self-service registration. As a further compensating control, place a WAF rule (e.g. Patchstack/Wordfence virtual patching) in front of the plugin's request handlers to filter SQL metacharacters, accepting that WAF rules can be bypassed and may cause false positives on legitimate recipe content. Restrict database privileges of the WordPress DB user to the minimum required so a successful injection cannot reach other databases on the same server.