What is the CVSS score of EUVD-2026-39380?

EUVD-2026-39380 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Post Snippets are affected by EUVD-2026-39380?

The Post Snippets WordPress plugin (versions 4.0.19 and earlier) contains a remote code execution vulnerability that allows any user with Contributor-level access to execute arbitrary code on…

How to fix or mitigate EUVD-2026-39380?

Within 24 hours: Identify all WordPress installations using Post Snippets plugin versions 4.0.19 or earlier; audit user accounts with Contributor or higher roles. Within 7 days: Disable the Post Snippets plugin across all affected sites, or upgrade to version 4.0.20 or later if available from the vendor; review and restrict Contributor role permissions to limit risk. Within 30 days: Implement WAF rules to monitor for exploitation patterns; review access logs from the past 90 days for suspicious contributor activity; document findings and establish a process to track plugin vulnerability notifications.

Post Snippets EUVD-2026-39380

| CVE-2026-56049 HIGH

Code Injection (CWE-94)

2026-06-25 Patchstack

GHSA-5rvc-gxqm-fm4r

WordPress RCE Code Injection Post Snippets Wordpress Plugin

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Contributor authentication gives PR:L; network-reachable with no interaction (AV:N/UI:N); a specific precondition warrants AC:H; code execution escapes the app boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:23 vuln.today

DescriptionCVE.org

Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

AnalysisAI

Remote code execution in the Post Snippets WordPress plugin (versions 4.0.19 and earlier) lets an authenticated user with only Contributor-level privileges inject and execute arbitrary PHP/code on the server via the plugin's snippet-handling functionality (CWE-94). Because a low-privilege role can pivot to full server compromise with a scope change (S:C), this is a privilege-escalation-to-RCE flaw reported by Patchstack; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Post Snippets is a WordPress plugin that lets users store reusable snippets of code/text and render them in posts, pages, or templates, typically via shortcodes or template tags. The vulnerability is a CWE-94 Code Injection issue: untrusted, attacker-controlled input is incorporated into a context that is evaluated as code (e.g., PHP evaluation of snippet content), so a user permitted to create or edit snippets can cause the server to execute their input. The affected CPE is cpe:2.3:a:post_snippets:post_snippets:*:*:*:*:*:*:*:*, covering all builds through 4.0.19. The CVSS scope change (S:C) reflects that code execution within the plugin/WordPress context breaks out to affect the underlying web server/host security boundary.

RemediationAI

No vendor-released patch version is identified in the available data, so the exact fixed release cannot be cited; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-19-remote-code-execution-rce-vulnerability) and the WordPress plugin repository for any release above 4.0.19 and upgrade to it as the primary fix. Until a confirmed patched version is applied, deactivate and remove the Post Snippets plugin if it is not essential (eliminates the attack surface but breaks any snippets currently rendered on the site). If the plugin must remain active, restrict who holds the Contributor role: audit and remove untrusted Contributor accounts, disable open/self-service user registration or set the default new-user role to Subscriber (trade-off: legitimate contributors lose self-service onboarding), and limit access to the plugin's snippet creation/editing screens to trusted administrators. Add a WAF/virtual-patching rule (e.g., Patchstack) to block the exploit pattern as a stopgap, accepting that signature-based controls may not cover all variants.