CVE-2026-110002 in Snazzy Social Media Feed Plugin
Summary
by MITRE • 10/14/2026
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The Snazzy Social Media Feed plugin for WordPress contains a critical Arbitrary File Upload vulnerability affecting all versions up to 2.5. This flaw resides within the standalone save-to-cache.php script, which operates outside the standard WordPress execution context. The root cause is a severe lack of security controls in this specific endpoint. Specifically, the script fails to include the necessary WordPress bootstrap files, resulting in an absence of authentication checks, capability verification, and nonce validation mechanisms that are typically enforced by the core platform. This architectural oversight allows any user with subscriber-level access or higher to interact directly with the file upload functionality without undergoing proper identity verification or permission auditing processes.
The technical mechanism of exploitation relies on insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file named cached-feed.php within the cached-content directory. The only filter applied to this input is FILTER_SANITIZE_URL, which removes certain characters but critically preserves others that are essential for crafting valid PHP payloads. Consequently, an attacker can inject malicious code into the URL parameter, which is then saved verbatim into the target file. Because the script does not validate or escape special characters relevant to server-side execution, the injected payload remains functional and executable within the context of the web server environment.
The operational impact of this vulnerability is severe, leading directly to Remote Code Execution on the affected WordPress installation. Since an attacker with low-privileged subscriber access can upload a PHP file containing arbitrary commands, they effectively gain the ability to execute code at the same privilege level as the web server process. This compromise allows for complete control over the website's backend, including the potential to exfiltrate sensitive data, modify site content, install further malware such as backdoors or web shells, and pivot into other systems within the network infrastructure. The ease of exploitation is heightened by the fact that no complex interaction with WordPress core functions is required; a single GET request targeting the crafted payload in cached-feed.php triggers immediate execution.
From a classification perspective, this vulnerability aligns with CWE-434: Unrestricted Upload of File with Dangerous Type and CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), although the primary impact here is server-side code execution rather than client-side effects. In terms of the MITRE ATT&CK framework, this exploit maps to T1505.003: Web Shell via Supply Chain Compromise or more accurately T1505.002: Web Shell via Plugin/Theme Upload, as it involves uploading a malicious file that is subsequently executed by the server. The lack of authentication and authorization checks also corresponds to CWE-862: Missing Authorization and CWE-347: Improper Verification of Cryptographic Signature if nonce validation were considered part of cryptographic verification in some contexts, but primarily it represents a failure in access control mechanisms defined under T1078: Valid Accounts.
Mitigation strategies must focus on immediate remediation and future hardening. The most effective solution is to update the Snazzy Social Media Feed plugin to version 2.6 or later, where these security flaws have been addressed by developers. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations should include restricting file upload permissions for subscriber-level users via WordPress role management plugins or custom code snippets that disable specific endpoints like save-to-cache.php for non-administrative roles. Additionally, implementing a Web Application Firewall can help block requests containing PHP tags in URL parameters before they reach the application logic. Long-term improvements require enforcing strict input validation using allowlists rather than denylists and ensuring all standalone scripts include proper WordPress bootstrap files to inherit core security features such as nonce verification and capability checks.