This vulnerability (CVE-2026-57663) is an improper neutralization of special elements used in an SQL command (CWE-89) in the Recipe Maker For Your Food Blog plugin from Zip Recipes by Igor Benic. It affects versions up to 8.2.7. The flaw allows an attacker with low privileges to perform SQL Injection attacks, potentially compromising confidentiality of the database. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with contributor-level privileges to execute arbitrary SQL commands, leading to disclosure of sensitive information (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. The vulnerability could compromise the confidentiality of the underlying database used by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted users.