Code Snippets, CVE-2026-106468

CVE, Research URL: CVE-2026-106468
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Published on: Nov 11, 2026
Research Description: The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.
Affected versions: max 4.1.0.
Status: vulnerable