CVE-2026-115282 Details
Description
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
A vulnerability exists in the Recipe Card Blocks Lite WordPress plugin in versions prior to 3.6.4. The issue arises because the plugin's recipe print feature does not include an authorization check before displaying posts. This flaw allows unauthenticated users to access and disclose the title, ID, and recipe content of unpublished posts, such as drafts, pending, private, and password-protected entries, that contain a recipe card block. Although the plugin offers an optional 'print only published posts' feature, it fails to prevent this issue, as the status check is applied to a different post than the one ultimately rendered.
Users are advised to update the Recipe Card Blocks Lite WordPress plugin to version 3.6.4 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/b80a2b0f-6d9a-4532-9a8e-65f889e8077b/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Recipe Card Blocks Lite | >= 2.6.4, <= 3.6.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |