Recipe Card Blocks Lite WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Recipe Card Blocks Lite WordPress plugin, affecting versions prior to 3.4.13. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This flaw allows users with contributor roles and above to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Reproduction

To reproduce this vulnerability, install and activate the Recipe Card Blocks Lite WordPress plugin version 3.4.12. Also, activate the WP Recipe Maker plugin. Create a recipe and add it to a post or page using the WPRM Recipe block. After publishing the post, leave a comment and rating. Log in as a contributor and navigate to the Recipe Cards section to find the 'ajax_nonce' value. This nonce can be used to send a POST request to 'admin-ajax.php', exploiting the SQL injection vulnerability by injecting SQL payloads into the 'recipe_id' parameter.

Remediation

Users are advised to update the Recipe Card Blocks Lite WordPress plugin to version 3.4.13 or later.