CVE-2026-106095 in Code Snippets Plugin
Summary
by MITRE • 10/09/2026
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Code Snippets WordPress plugin versions prior to 3.10.0 represents a critical flaw in access control logic within a multi-tenant environment. Specifically, the issue stems from an insufficient capability check on specific snippet-management actions and a flawed method for determining the operational scope of code snippets. In a standard single-site installation, this might result only in minor administrative confusion; however, in WordPress multisite configurations, where multiple distinct sites share a single database and application instance, the implications are severe. The plugin fails to verify whether the requesting user possesses the necessary privileges not just for their current subsite context, but also for actions that affect the entire network infrastructure. This oversight allows an administrator of any individual subsite within the multisite network to execute commands intended only for super-administrators who manage the global network settings.
The technical root cause lies in two distinct failures during request processing. First, the plugin does not adequately validate user capabilities before executing snippet management actions such as activation, deactivation, or reprioritization. Second, and more critically, the application logic derives the scope of a snippet from parameters present in the HTTP request rather than querying the persistent storage to confirm the actual stored state of that specific record. By trusting client-supplied data regarding whether a snippet is network-scoped, an attacker can manipulate these parameters to bypass intended restrictions. This design pattern violates the principle of least privilege and fails to enforce server-side authorization checks against authoritative source-of-truth records in the database.
The operational impact of this vulnerability allows for significant unauthorized control over the WordPress multisite environment. An authenticated user with administrator privileges on a single, potentially low-privilege subsite can activate or deactivate snippets that are configured to run across every site in the network. This means that malicious code injected via these snippets will execute globally, affecting all users and content across the entire multisite installation regardless of which specific subdomain they visit. Furthermore, the ability to reprioritize snippets allows an attacker to manipulate execution order, potentially causing conflicts with other plugins or themes, leading to application instability or denial-of-service conditions for legitimate users. The most dangerous aspect is that network-scoped snippets often have elevated permissions and broad access to WordPress internals, meaning a compromised snippet can lead to full site compromise, data exfiltration, or the installation of persistent backdoors across all subsites.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management, as it involves an actor obtaining privileges that they are not explicitly authorized to possess. It also relates closely to CWE-862: Missing Authorization, where the application fails to enforce access controls on resources or functions. In terms of adversary tactics, this flaw facilitates lateral movement within a multisite architecture and aligns with MITRE ATT&CK techniques such as T1078: Valid Accounts, specifically when used by lower-level administrators to escalate their influence across the network infrastructure. The exploitation does not require complex injection vectors but relies on simple parameter manipulation of existing administrative endpoints, making it highly exploitable for automated attacks if authentication credentials are obtained through other means like phishing or credential stuffing.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the Code Snippets plugin to version 3.10.0 or later, where these authorization checks have been corrected to validate user capabilities against network-level permissions rather than subsite roles. For environments unable to patch immediately due to compatibility constraints, administrators should restrict access to WordPress admin areas using IP whitelisting or multi-factor authentication to reduce the attack surface for authenticated attacks. Additionally, implementing a Web Application Firewall with rules that detect anomalous parameter changes in snippet management endpoints can provide an additional layer of defense. Long-term, developers and site operators should audit all custom code and plugins for similar patterns where request parameters dictate security-critical state variables instead of relying on server-side database lookups to enforce business logic and access controls consistently across multi-tenant deployments.