CVE-2026-106468
Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.
| Vendor | unknown |
| Product | code snippets |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown code snippets
Be the first to know when new unknown vulnerabilities affecting unknown code snippets are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Code Snippets
0 < 4.1.0
References
Credits
Artus KG WPScan