CVE-2026-115282

Name of the Vulnerable Software and Affected Versions Recipe Card Blocks Lite versions 2.6.4 through 3.6.3

Description The plugin fails to perform an authorization check before rendering posts via the recipe print feature. This allows unauthenticated users to disclose the title, ID, and recipe content of unpublished posts, including drafts, pending, private, and password-protected posts that contain a recipe card block. The optional print only published posts protection is ineffective because the status check is applied to a different post than the one rendered.

Recommendations Update Recipe Card Blocks Lite to version 3.6.4 or later.