What the vulnerability does
01Description
The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-43275 appears to be a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
02Summary
Insert PHP Code Snippet versions up to 1.3.6 lack CSRF protection on administrative actions. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted changes to the plugin's settings or code snippets without the admin's knowledge or consent.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into modifying plugin settings or PHP code snippets via a malicious webpage.
Potential impact on your site
04Site Impact
Attackers can alter PHP code execution on your site if an admin visits a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit an attacker-controlled webpage; no special privileges or user interaction beyond visiting the page.
Key dates
06Disclosure timeline
August 15, 2024
CVE published
April 8, 2026
Record updated
