Arbitrary File Upload Vulnerability in Snazzy Social Media Feed Plugin for WordPress

CVE-2026-110002

What is CVE-2026-110002?

The Snazzy Social Media Feed plugin for WordPress has a vulnerability that allows authenticated users with subscriber access or higher to perform arbitrary file uploads. This occurs through the file scope in the save-to-cache.php script, which lacks essential WordPress bootstrap, authentication, and nonce checks. The plugin fails to sanitize the pluginURL parameter effectively, permitting the creation of a malicious PHP payload that can be executed via a simple web request. This vulnerability emphasizes the importance of proper input validation and authentication measures, as exploitable scripts being directly accessible can pose significant risks to website security.

References