WPCode EUVD-2026-100974

Requires a WordPress site running WPCode plugin before version 2.4.0 with one or more automatically inserted (auto-insert) snippets configured; the attacker sends a request that is incorrectly recognized as a login-screen request, triggering snippet safe mode. No authentication, user interaction, or special configuration beyond default auto-inserted snippets is required. The key LIMITING factor is scope: the snippet suppression applies only to the attacker's own requests, so it cannot disable snippets for other visitors or alter the site globally - reducing impact to bypassing snippet-enforced behavior (e.g., injected headers, redirects, or access/content controls) within the attacker's own session.

This is a low-severity (CVSS 5.3) WordPress plugin flaw whose real-world priority is modest despite affecting a widely deployed product. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms unauthenticated, low-complexity network exploitation with no user interaction, but the impact is limited to Confidentiality:Low with no integrity or availability effect, and critically the condition only disables snippets for the ATTACKER'S OWN requests - not for other visitors or the site globally. Publicly available exploit code exists (reported by WPScan), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation. The signals are therefore consistent rather than conflicting: easy to trigger, but self-scoped and low-impact. The practical concern is that an attacker can bypass security- or access-control-related snippets for their own session (e.g., snippets that inject headers, redirects, or content restrictions), making this a defense-weakening/information-exposure issue rather than a site-takeover vector. No EPSS value was supplied, so exploitation probability cannot be quantified from the input.

An unauthenticated attacker sends a specially crafted HTTP request that the vulnerable WPCode plugin mistakenly treats as a login-screen request, causing it to enter snippet safe mode and skip all automatically inserted snippets for that request. The attacker thereby bypasses any protection, redirect, or content-control logic implemented via WPCode snippets for their own session. Public exploit code for this technique is available via WPScan.