NextScripts SNAP EUVD-2026-87902

Exploitation requires an authenticated WordPress user whom an administrator has explicitly granted access to SNAP's posting features (a non-default, per-site trust grant), and the attacker must supply a valid nonce obtainable from the plugin interface. The vulnerable AJAX actions perform no capability or ownership check, so any such granted user - regardless of intended limited role - can export the configured social account credentials, delete arbitrary posts, and reset the plugin configuration. Limiting factors: the plugin (SNAP before 4.4.8) must be installed and active, the attacker must already hold plugin posting access (rules out anonymous internet attackers), and no admin-level privilege is actually needed despite the vendor's PR:H rating.

This is a moderate-risk, authorization (CWE-862) flaw in the NextScripts: Social Networks Auto-Poster (SNAP) WordPress plugin. Signals point consistently toward limited urgency: EPSS is very low (0.13%, 2nd percentile), the CVE is NOT in CISA KEV, and CISA SSVC records Exploitation=none and Automatable=no - while acknowledging Technical Impact=total. Working against that, publicly available exploit code exists (WPScan) and the technical impact is severe (credential theft plus arbitrary post deletion and config reset). The vendor CVSS 3.1 vector (5.9, AV:N/AC:H/PR:H/UI:N/C:H/I:H) understates real risk in one respect: PR:H is questionable - the described attacker is a lower-privileged user whom an administrator has merely granted access to SNAP's posting features, not a full administrator, so PR:L is more defensible and would raise the score. Conversely, exploitation is genuinely gated: the attacker must already be an authenticated user with plugin posting access, matching SSVC's 'not automatable' and non-widespread outlook. Net: a real but bounded insider/privilege-abuse issue rather than a mass-exploitation priority. Note the CVSS vector and description agree on network vector and authentication requirement, so no vector/description conflict here.

A WordPress site administrator grants a marketing or contributor account access to SNAP's auto-posting features. That authenticated sub-admin user invokes the plugin's unprotected AJAX actions (which check only a nonce, not capability or ownership) to export the stored social-network account credentials, delete arbitrary posts, and reset the plugin configuration. Public exploit code from WPScan lowers the effort required to reproduce this.