Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-106095: Code Snippets plugin lets subsite admin control network snippets
CVE-2026-106095 · published 10 days ago
Summary
The Code Snippets add‑on for WordPress (versions before 3.10.0) lets a user who only manages one site on a multisite installation turn on, turn off, or change the order of code that runs on every site in the network. This can let a lower‑privilege admin affect the entire network’s behavior. Updating the plugin to version 3.10.0 or later resolves the issue.
What to do
- Update unknown code snippets to version 3.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | code snippets | < 3.10.0 |
Original advisory text
Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.3
Low
Type
CWE-862Missing Authorization
Timeline
Published9 Oct 2026
Updated15 Oct 2026
First seen9 Oct 2026
Track software like this
Free during beta