CVE-2026-106097 in Code Snippets Plugin
Summary
by MITRE • 10/09/2026
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in the Code Snippets WordPress plugin prior to version 3.10.0 represents a critical security flaw rooted in insufficient input validation and sanitization within specific API endpoints designed for snippet migration imports. This issue specifically affects functions that handle user-supplied parameters intended for database operations without applying appropriate escaping mechanisms before constructing SQL queries. The severity of this vulnerability is significantly amplified by the privilege level required to exploit it, as access to these vulnerable endpoints is granted to any user possessing site-administration capabilities within a WordPress environment. In standard single-site installations, this limits exploitation to administrators, but in WordPress Multisite networks, the scope expands considerably because subsite Administrators are also granted access to these endpoints despite lacking network-wide Super Admin privileges. This architectural nuance creates an opportunity for privilege escalation and lateral movement across the multisite infrastructure, allowing lower-privileged users to interact with shared database tables that they should not theoretically have direct write or read access to in a properly secured environment.
From a technical perspective, the core flaw is classified as SQL Injection, specifically leveraging UNION-based techniques to extract data from the database. By manipulating the unsanitized input parameters within the migration import endpoints, an attacker can inject malicious SQL code that alters the logic of the original query. This allows the injection of additional SELECT statements via the UNION operator, which enables the retrieval of arbitrary data from other tables in the same database schema. Because WordPress Multisite networks share a single database with multiple prefixes for different sites, this vulnerability permits an attacker to bypass isolation boundaries between subsites. The most critical impact involves the ability to query and disclose sensitive information stored in shared network tables, such as user authentication keys, salts, and password hashes. These credentials are central to the security of all users across the entire multisite network, making their exposure a catastrophic failure of confidentiality controls that can lead to full account compromise for both regular users and high-privilege administrators.
The operational impact of this vulnerability extends beyond simple data disclosure. Once an attacker obtains valid password hashes from the shared database tables, they can proceed with offline brute-force or rainbow table attacks to recover plaintext passwords. With these credentials in hand, the attacker can authenticate as any user within the network, including Super Admins who manage the entire multisite installation. This effectively neutralizes the intended privilege separation between subsite Administrators and Network Super Admins, granting the former control over the latter. Furthermore, access to administrative accounts allows for further exploitation vectors such as installing malicious plugins, modifying site configurations, or defacing websites across multiple domains hosted on the same network infrastructure. The ability to execute arbitrary SQL queries also poses a risk of data integrity loss if an attacker chooses to modify rather than just read database records, potentially disrupting service availability or corrupting critical application state information.
In terms of industry standard classifications, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific technique employed falls under the category of UNION-based injection, where additional queries are appended to a legitimate query to extract data from other tables. From a threat intelligence perspective, this behavior maps closely to MITRE ATT&CK techniques related to Database Querying and Credential Access. Specifically, it reflects tactics used by attackers to gather sensitive information for lateral movement within an organization or network environment. The exploitation of shared database resources in multisite environments highlights the importance of strict privilege boundaries and secure coding practices when handling user input that interacts with backend data stores.
To mitigate this vulnerability, organizations running WordPress Multisite networks must immediately update the Code Snippets plugin to version 3.10.0 or later, where these sanitization issues have been addressed by developers through proper escaping of all user-supplied inputs before their inclusion in SQL statements. Until an upgrade is feasible, administrators should consider restricting access to migration-related endpoints if possible, although this may not be entirely practical given the plugin's functionality requirements. It is also crucial to audit existing database permissions and ensure that the WordPress database user does not have excessive privileges beyond what is necessary for application operation, adhering to the principle of least privilege. Regular security audits and code reviews focusing on SQL query construction can help identify similar vulnerabilities in other plugins or custom themes. Additionally, implementing Web Application Firewalls with robust SQL injection detection rules may provide a layer of defense against exploitation attempts while patch management processes are underway.