Code Snippets <= 4.0.0 - Authenticated (Administrator+) Missing Authorization to Network Snippet Import
- ID
- WPSEC-2026-2642
- Plugin
- Code Snippets (code-snippets)
- Affected
- from 3.9.4 before 4.1.0
- Remediation
- Update to 4.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Code Snippets on WPSec AttackSurface
- Fix released
- Published
Description
The Code Snippets plugin for WordPress is vulnerable to unauthorized modification of data via the snippet import REST routes (file upload import and third-party plugin import) in all versions up to, and including, 4.0.0, due to the routes' permission callbacks checking only the site-level snippet capability while honouring a 'network' parameter that writes to the network snippets table. This makes it possible for authenticated attackers with subsite administrator access on a multisite installation to create network snippets, or overwrite existing network snippets with the same name, without the network snippet capability.
References
- https://wpsec.com/vuln/WPSEC-2026-2642/
- https://plugins.svn.wordpress.org/code-snippets/tags/4.1.0/
- https://wordpress.org/plugins/code-snippets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS