CVSS 3.8 (low) · published 2026-11-11
The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.
Weakness: CWE-862
Source: NVD CVE-2026-106468
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.