What is the CVSS score of EUVD-2026-15609?

EUVD-2026-15609 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Post Snippets are affected by EUVD-2026-15609?

CVE-2026-25001 presents significant security risk, a code injection vulnerability rated CVSS 8.5.

How to fix or mitigate EUVD-2026-15609?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Post Snippets EUVD-2026-15609

| CVE-2026-25001 HIGH

Code Injection (CWE-94)

2026-03-25 Patchstack

GHSA-mgq2-f9fr-xpmw

RCE Code Injection Post Snippets

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15609

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.5

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.

AnalysisAI

The Post Snippets WordPress plugin versions up to and including 4.0.12 contain an improper code generation vulnerability (CWE-94) that enables remote code injection and execution. An attacker can exploit this flaw to execute arbitrary code on affected WordPress installations, potentially leading to complete site compromise. The vulnerability has been publicly documented by Patchstack with available references, and the attack vector appears to be network-based without requiring high privileges.

Technical ContextAI

The vulnerability resides in the Saad Iqbal Post Snippets plugin (CPE: cpe:2.3:a:saad_iqbal:post_snippets:*:*:*:*:*:*:*:*), which is a WordPress plugin used for managing code snippets. The root cause is classified under CWE-94 (Improper Control of Generation of Code), a weakness where user-controlled input is improperly sanitized before being processed as executable code. This typically occurs when the plugin dynamically generates or includes code without adequate validation, allowing an attacker to inject malicious PHP or similar code that gets executed in the WordPress environment. The affected versions through 4.0.12 lack sufficient input validation mechanisms to prevent code injection attacks, likely in features related to snippet creation, storage, or rendering.

RemediationAI

Immediately upgrade the Post Snippets plugin to a patched version beyond 4.0.12 if such a version is available from the plugin author (verify current status at the Patchstack advisory link). If a patched version is not yet released, disable and deactivate the Post Snippets plugin until a security update becomes available, then implement an alternative code snippet management solution. As an interim defensive measure, restrict direct access to WordPress administrative interfaces using IP whitelisting, implement a Web Application Firewall (WAF) with rules to detect code injection patterns in POST requests, and enable comprehensive WordPress security logging to detect exploitation attempts. Monitor the plugin's official repository and Patchstack for patch availability notifications, and test any update in a staging environment before deploying to production.