What the vulnerability does
01Description
The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
Explanation of Vulnerability in Simple Terms
02Summary
Code Snippets versions 3.9.4 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. The vulnerability requires the victim to visit the attacker's page while authenticated.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify site settings or content if they trick your admin into visiting a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage; no special privileges or authentication by the attacker required.
Key dates
06Disclosure timeline
February 6, 2026
CVE published
April 8, 2026
Record updated
