Code Snippets EUVD-2026-95506

Requires a WordPress multisite network running Code Snippets prior to 3.10.0, with at least one network-scoped snippet already configured, and the attacker must already hold administrator privileges on at least one subsite (PR:H). Exploitation is limited by these factors: it only applies to multisite installations (a non-default WordPress deployment mode), it requires existing authenticated subsite-admin access rather than anonymous access, and the action is constrained to activating/deactivating/reprioritising existing snippets rather than injecting new code. These constraints (reflected in AC:H and PR:H) sharply narrow the realistic exposure to organisations running multisite WordPress with delegated subsite administrators.

This is a genuinely low-priority, high-noise-floor issue despite being a real authorization flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L, base 3.3 Low) is internally consistent with the description: PR:H reflects that the attacker must already be an administrator of a subsite, and AC:H reflects the dependence on a WordPress multisite deployment with pre-existing network-scoped snippets. EPSS is very low (0.13%, 2nd percentile), aligning with the Low CVSS and indicating no meaningful mass-exploitation signal. The vulnerability is NOT in CISA KEV (no active-exploitation signal), but publicly available exploit code exists (WPScan), so the signals are consistent rather than conflicting: a disclosed, documented bug with a POC but no evidence of in-the-wild use. No SSVC decision data was provided in the input, so exploitation status is assessed only from KEV (not listed) and POC (available). The one caveat worth stating explicitly: the impact metrics (I:L/A:L, C:N) treat this as mere toggling of existing snippets, but because those snippets execute PHP across every site in the network, a creative attacker who also controls or influences snippet content could amplify impact - however, nothing in the provided data supports arbitrary code injection, so this remains a privilege/authorization boundary issue, not RCE. Net: real but low priority outside multisite WordPress fleets.

On a WordPress multisite network running Code Snippets before 3.10.0, a user who only has administrator rights over a single subsite sends a crafted snippet-management request whose network-scope parameter targets a network-wide snippet. Because the plugin skips the capability check and trusts the request-supplied scope instead of the stored record, the subsite admin can activate, deactivate, or reprioritise network-scoped snippets that run on every site in the network. A public exploit/advisory exists (WPScan), but there is no evidence of active exploitation.