EUVD-2026-14152
GHSA-x8rg-w4fm-9p2g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Post Snippits WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation on settings page handlers that manage snippet creation, modification, and deletion. Unauthenticated attackers can exploit this by crafting malicious requests that, when clicked by an administrator, allow injection of arbitrary scripts and modification of plugin settings, potentially leading to site compromise. The vulnerability has a CVSS score of 6.1 with a network attack vector requiring user interaction.
Technical ContextAI
The vulnerability stems from insufficient CSRF protection in the Post Snippits plugin (CPE: cpe:2.3:a:phy9pas:post_snippits:*:*:*:*:*:*:*:*), which is classified as CWE-352 (Cross-Site Request Forgery). The plugin processes administrative actions—specifically saving, adding, and deleting code snippets—through WordPress settings page handlers without implementing WordPress nonce verification mechanisms. WordPress nonces are cryptographic tokens that validate requests originated from legitimate admin sessions. Source code analysis from the official WordPress plugin repository (lines 55, 71, and 77 in post-snippits.php) shows the vulnerable handlers lack proper wp_verify_nonce() or check_admin_referer() calls, allowing attackers to forge requests that execute plugin functionality with the privileges of a logged-in administrator. The attack surface is the WordPress admin interface where plugin settings are managed.
RemediationAI
Site administrators should immediately deactivate and remove the Post Snippits plugin from their WordPress installations until a patched version is released. The primary remediation is to upgrade to a patched version once available from the plugin developer (monitor https://plugins.trac.wordpress.org/ for updates). Until a fix is released, WordPress administrators should restrict access to the WordPress admin dashboard using IP whitelisting, implement Web Application Firewall (WAF) rules to block requests to plugin settings pages from untrusted sources, enforce strong authentication mechanisms such as two-factor authentication (2FA), and educate administrators to avoid clicking suspicious links from untrusted sources. Additionally, review all active snippets in the plugin settings before removal to identify any unauthorized code injection that may have already occurred. See Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=cve for more details.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today