CVE-2026-106097
Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
| Vendor | unknown |
| Product | code snippets |
| Published | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown code snippets
Be the first to know when new unknown vulnerabilities affecting unknown code snippets are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Code Snippets
0 < 3.10.0
References
Credits
Sarthak Saxena WPScan