Recipe Card Blocks Lite <= 3.6.4 - Authenticated (Contributor+) Sensitive Information Exposure via Embedded Recipe Shortcode, Block and Elementor Widget
- ID
- WPSEC-2026-2776
- Plugin
- Recipe Card Blocks Lite (recipe-card-blocks-by-wpzoom)
- Affected
- from 3.0.0 before 3.6.5
- Remediation
- Update to 3.6.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Recipe Card Blocks Lite on WPSec AttackSurface
- Fix released
- Published
Description
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Sensitive Information Exposure via the [wpzoom_rcb_post] shortcode, the Recipe Block From Posts block and the Elementor recipe card widget in all versions up to, and including, 3.6.4. This is due to insufficient visibility checks on the user-supplied recipe ID. The shortcode and the Elementor widget load any post by ID and render its blocks without checking its post type, status or password protection. The block checks status and post type but not password protection. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed and preview the content of draft, pending, private or password-protected recipes and other posts that they should not be able to read.
References
- https://wpsec.com/vuln/WPSEC-2026-2776/
- https://plugins.svn.wordpress.org/recipe-card-blocks-by-wpzoom/tags/3.6.5/
- https://wordpress.org/plugins/recipe-card-blocks-by-wpzoom/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS