Skip to content
Sign in
3.3 Low

CVE-2026-106095 The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management…

Description

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.

Affected products and versions

Product Affected versions Fixed in
Code Snippets 3.10 earliest → < 3.10.0 3.10.0

Other CVEs of Code Snippets

The 3 CVEs of Code Snippets →
CVE-2026-106097 The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using… 6.8 Medium CVE-2021-25008 The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it… Not rated
Track this CVE