Code Snippets CVE-2026-106097

Requires WordPress Multisite ('network') deployment with the Code Snippets plugin (before 3.10.0) installed network-wide, AND the attacker must already hold site-administration capabilities - specifically a subsite Administrator role - but need NOT be a network Super Admin. The exploit targets the snippet-migration import endpoints, so those endpoints must be reachable by that role. LIMITING FACTORS: no anonymous/unauthenticated path (PR:H); the high-value cross-subsite data disclosure is meaningful primarily in multi-tenant Multisite networks where subsite admins are untrusted - on a single-site install the acting admin would already have legitimate database access, sharply reducing real-world impact. No end-user interaction is required (UI:N).

This is a genuine but mid-tier priority rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8 Medium) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires PR:H - site-administration capabilities - so it is NOT unauthenticated. The scope change (S:C) is well justified because a subsite Administrator, confined to their own site, can read network-wide shared tables, crossing a privilege/authorization boundary. All exploitation signals point the same direction and do not conflict: EPSS is low at 0.16% (4th percentile), SSVC reports Exploitation: none and Automatable: no with only partial technical impact, and the CVE is NOT on CISA KEV. The one escalating signal is that publicly available exploit code exists (WPScan). Taken together, POC availability raises the floor on who can attempt this, but the high-privilege prerequisite and lack of automatability keep real-world mass-exploitation probability low - this most plausibly matters in WordPress Multisite environments that delegate subsite administration to semi-trusted tenants, where it enables privilege-boundary violation (e.g. harvesting other users' password hashes). Note: the low EPSS/SSVC exploitation rating despite a public POC suggests opportunistic or targeted use against specific multisite hosters rather than widespread scanning.

A WordPress Multisite network grants a tenant subsite Administrator rights but deliberately withholds network Super Admin. That user invokes the Code Snippets migration/import endpoint and supplies a crafted value in the vulnerable parameter to perform UNION-based SQL injection against shared network tables, reading data outside their subsite such as other users' password hashes. Public exploit code from WPScan lowers the skill barrier; the attack is network-delivered and low-complexity but requires the attacker to already hold site-administration capabilities.