The Recipe Card Blocks Lite plugin fails to verify that a user is authorized to view a post before rendering it through its recipe print feature. This allows an unauthenticated user to retrieve the title, ID, and full recipe content of posts that are drafts, pending, private, or password protected, effectively exposing sensitive, unpublished content. The weakness is a classic case of missing authorization checks that lead to information disclosure.

WordPress installations running the Recipe Card Blocks Lite plugin version 3.6.3 or earlier are impacted. The vulnerability is present in all editions of the plugin that employ the recipe print feature, regardless of WordPress version. No vendor-specific version numbers are provided beyond the range 2.6.4 to 3.6.3, so any deployment of those releases is susceptible.

The vulnerability carries a high exploitation risk due to the lack of an authentication step and the ability to trigger it via a crafted URL to the public recipe print endpoint. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not yet be actively exploited in the wild. Nevertheless, any unauthenticated user can acquire private content simply by visiting the recipe print page, resulting in a direct breach of confidentiality.