Snazzy Social Media Feed EUVD-2026-100775

The Snazzy Social Media Feed (snazzy-cacheable-facebook-feed) plugin version ≤2.5 must be installed, and its standalone functions/save-to-cache.php script must be web-reachable with the cached-content/ directory writable and web-executable. Exploitation requires only a single GET request supplying a pluginURL parameter whose PHP payload survives FILTER_SANITIZE_URL (the only filter applied) and is written into cached-feed.php. Per the CVSS vector (PR:N) and the stated absence of any WordPress bootstrap, authentication, capability, or nonce check, NO authentication or user interaction is required - this contradicts the description's 'subscriber-level access' wording, which should be verified with the vendor. The main limiting factors are that the target must run the vulnerable plugin version and the attacker must know/reach the direct script path.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) describes a trivially exploitable, network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact, and the technical detail supports this: save-to-cache.php is directly reachable without loading WordPress and performs no auth, capability, or nonce check, so a single GET request writes an attacker-controlled PHP file that is immediately executable. There is a NOTABLE INTERNAL CONFLICT in the source data: the prose states 'authenticated attackers, with subscriber-level access and above,' yet the same description says the script loads no WordPress bootstrap and enforces no authentication - the CVSS vector PR:N and the 'directly reachable without loading WordPress' detail both indicate NO authentication is actually required, so the 'subscriber-level' phrasing appears to be boilerplate that contradicts the technical mechanism; defenders should treat this as unauthenticated pending vendor confirmation. No EPSS score, KEV listing, POC reference, or SSVC decision data was provided in the input, so real-world exploitation signals are absent - this is currently a high-CVSS issue whose active-exploitation likelihood cannot be quantified from the given data. However, the primitive (unauthenticated RCE via file upload with insufficient sanitization, CWE-434) is exactly the class that gets mass-scanned and weaponized quickly once public, so it should be treated as a genuine high priority to patch despite the absence of exploitation telemetry.

An attacker sends a crafted GET request directly to the standalone save-to-cache.php endpoint with a pluginURL parameter containing a PHP payload; because WordPress is never loaded and FILTER_SANITIZE_URL preserves the payload characters, the data is written verbatim into cached-content/cached-feed.php. The attacker then requests that cached PHP file to execute arbitrary code on the server. No public exploit identified at time of analysis, though the attack is low-complexity (AC:L) and requires no user interaction.