# CVE-2026-115282: Recipe Card Blocks Lite authorization bypass in recipe print

Source: https://junglewise.ai/threats/cve-2026-115282-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-115282 · Severity: info · Published 2026-10-29

The Recipe Card Blocks Lite WordPress plugin allows unauthenticated attackers to read the content of unpublished posts (drafts, pending, private, password-protected) through a recipe print feature. An attacker can view sensitive post titles, IDs, and recipe content that was never intended to be visible to the public, potentially exposing confidential recipes, planning information, or other sensitive material stored in WordPress.

Technologies: [WPZOOM Recipe Card Blocks Lite](https://junglewise.ai/threats/technologies/recipe-card-blocks-lite). Vendors: [WPZOOM](https://junglewise.ai/threats/vendors/wpzoom).

## Quick answers

**Is CVE-2026-115282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115282 being exploited in the wild.

**How severe is CVE-2026-115282?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** WPZOOM Recipe Card Blocks Lite before 3.6.4.

**Is there a fix for CVE-2026-115282?** Yes: fixed in Recipe Card Blocks Lite 3.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115282 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115282?** Check whether you run WPZOOM Recipe Card Blocks Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Recipe Card Blocks Lite 3.6.4

## Technical details

The plugin fails to perform authorization checks before rendering posts via its recipe print feature, allowing unauthenticated access to unpublished post content. The vulnerability affects posts with recipe card blocks; an optional "print only published posts" protection is ineffective because the status check is applied to a different post than the one ultimately rendered. An unauthenticated, network-based attacker can exploit this with no user interaction required to disclose post titles, IDs, and recipe content from drafts, pending, private, and password-protected posts.

## Affected products

- WPZoom Recipe Card Blocks Lite before 3.6.4

## Timeline

- 2026-10-26: disclosed
- 2026-10-29: advisory

## References

- [https://wpscan.com/vulnerability/b80a2b0f-6d9a-4532-9a8e-65f889e8077b/](https://wpscan.com/vulnerability/b80a2b0f-6d9a-4532-9a8e-65f889e8077b/)

## Related threats

- [WordPress Recipe Card Blocks Lite SQL injection in shortcode attribute](https://junglewise.ai/threats/cve-2026-115281-the-recipe-card-blocks-lite-wordpress-plugin-before-3-6-4-does)
- [WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes](https://junglewise.ai/threats/cve-2026-3011-wpzoom-recipe-card-blocks-lite-stored-xss-in-recipe-attributes)