What the vulnerability does
01Description
The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the "Enable file-based execution" setting and creating at least one active Content snippet.
Explanation of Vulnerability in Simple Terms
02Summary
Code Snippets versions 3.9.1 and earlier allow authenticated users to inject and execute arbitrary PHP code on the site. An attacker with low-level account access can craft malicious input that runs their own code with full site privileges. The vulnerability requires user interaction and affects confidentiality, integrity, and availability.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full privileges.
Potential impact on your site
04Site Impact
Complete site compromise: data theft, malware injection, user account takeover, or site defacement.
Conditions required to exploit
05Prerequisites
Low-level user account (e.g., contributor or subscriber) and ability to trick an admin into clicking a malicious link.
Key dates
06Disclosure timeline
November 19, 2025
CVE published
April 8, 2026
Record updated
