Description
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Recipe Card Blocks Lite | 3.5.0 – < 3.6.4 | 3.6.4 |
References
- https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/ exploit vdb-entry technical-description