Post Snippets CVE-2026-56049

Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS PR:L) on a site running Post Snippets version 4.0.19 or earlier, used to create or edit a snippet whose content is then evaluated as code. The vulnerability is network-reachable with no user interaction needed (AV:N/UI:N), but high attack complexity (AC:H) indicates a non-default or specific condition must be satisfied to trigger code evaluation rather than a one-shot request. Limiting factors that reduce realistic risk: the Contributor account requirement (sites without untrusted authors or open registration are far harder to attack), the AC:H precondition, and dependence on the plugin being installed and active; sites that have disabled self-registration or restricted snippet editing to admins substantially blunt this.

Signals are mixed but lean toward genuine priority for any site running this plugin. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5 High) indicates a network-reachable, no-user-interaction flaw that nonetheless requires authentication (PR:L, a Contributor account) and has high attack complexity (AC:H), implying a non-trivial condition or specific configuration must be met rather than a trivially repeatable exploit. There is no EPSS score, no KEV listing, and no POC referenced in the provided data, so there is no evidence of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The key real-world gate is that Contributor accounts must exist and be obtainable; on sites with open registration granting Contributor role, or multi-author blogs, the barrier is low and the full C:H/I:H/A:H + scope-change RCE makes this high priority. On single-admin sites with no untrusted authors, real risk is materially lower despite the high CVSS. The AC:H rating should be verified against the vendor advisory to understand the exact precondition.

An attacker registers or obtains a Contributor account on a WordPress site running Post Snippets <= 4.0.19, then crafts a snippet whose contents are evaluated as PHP by the plugin, satisfying the specific condition implied by the high attack complexity. When the snippet is processed/rendered, the injected code executes on the web server with the application's privileges, giving the attacker remote code execution and a path to full host compromise. No public proof-of-concept is referenced, so an attacker would need to derive the trigger from the advisory or source.