Code Snippets, CVE-2026-1785

CVE, Research URL: CVE-2026-1785
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Published on: Feb 06, 2026
Research Description: The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
Affected versions: max 3.9.5.
Status: vulnerable