# CVE-2026-115281: WordPress Recipe Card Blocks Lite SQL injection in shortcode attribute

Source: https://junglewise.ai/threats/cve-2026-115281-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-115281 · Severity: info · Published 2026-10-28

Recipe Card Blocks Lite is a WordPress plugin for creating recipe content. Authenticated users with Contributor-level access can inject malicious SQL code through unsanitized shortcode attributes, potentially accessing or modifying the WordPress database without proper authorization.

Technologies: [WPZOOM Recipe Card Blocks Lite](https://junglewise.ai/threats/technologies/recipe-card-blocks-lite). Vendors: [WPZOOM](https://junglewise.ai/threats/vendors/wpzoom).

## Quick answers

**Is CVE-2026-115281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115281 being exploited in the wild.

**How severe is CVE-2026-115281?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** WPZOOM Recipe Card Blocks Lite 3.5.0 through 3.6.3.

**Is there a fix for CVE-2026-115281?** Yes: fixed in 3.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115281 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115281?** Check whether you run WPZOOM Recipe Card Blocks Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.6.4

## Technical details

The plugin concatenates unsanitized block and shortcode attributes (specifically the 'recipeId' parameter) directly into SQL queries without proper sanitization or type casting. This allows authenticated attackers with Contributor-level permissions or above to perform SQL injection attacks. The vulnerability was fixed in version 3.6.4.

## Affected products

- WPZoom Recipe Card Blocks Lite 3.5.0 through 3.6.3

## Timeline

- 2026-10-26: disclosed
- 2026-10-28: advisory

## References

- [https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/](https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/)

## Related threats

- [Recipe Card Blocks Lite authorization bypass in recipe print](https://junglewise.ai/threats/cve-2026-115282-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does)
- [WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes](https://junglewise.ai/threats/cve-2026-3011-wpzoom-recipe-card-blocks-lite-stored-xss-in-recipe-attributes)