Insufficient Capability Check in Code Snippets Plugin for WordPress
CVE-2026-106095

Currently unrated

Key Information:

Vendor

WordPress
Status
Code Snippets
Vendor
CVE Published:
9 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106095?

The Code Snippets plugin for WordPress, prior to version 3.10.0, contains a vulnerability that allows an administrator of a single subsite within a multisite network to manipulate snippets for the entire network. This occurs because the plugin does not conduct a proper capability check on certain snippet-management actions and improperly derives the network scope from the request rather than from the stored record. Consequently, this oversight enables unauthorized activity, such as activating, deactivating, and prioritizing snippets across all sites in the network.

Affected Version(s)

Code Snippets 0 < 3.10.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106095 - Proof of Concept

References

https://wpscan.com/vulnerability/4aeddbb6-d7a9-48cb-96ea-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Abd Alrahman
WPScan
.