Post Snippets <= 4.2.4 - Authenticated (Subscriber+) Missing Authorization to AI Chatbot AJAX Actions
- ID
- WPSEC-2026-1505
- Plugin
- Post Snippets – Custom WordPress Code Snippets Customizer (post-snippets)
- Affected
- from 4.2.0 before 4.2.5
- Remediation
- Update to 4.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-23
- Attack surface
- Post Snippets on WPSec AttackSurface
- Fix released
- Published
Description
The Post Snippets plugin for WordPress is vulnerable to unauthorized access via the check_api_key and chatbot_ask AJAX actions in all versions up to, and including, 4.2.4, due to a missing capability check. The handlers only verify the 'chatbot_nonce' nonce, and that nonce is printed on every wp-admin page, including the profile page any logged-in user can open. This makes it possible for authenticated attackers, with subscriber-level access and above, to check whether an OpenAI API key is configured and to send arbitrary chat requests through the site's configured OpenAI API key, using up the site owner's API quota and credit.
References
- https://wpsec.com/vuln/WPSEC-2026-1505/
- https://plugins.svn.wordpress.org/post-snippets/tags/4.2.5/
- https://wordpress.org/plugins/post-snippets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS