PT-2026-6692 · WordPress · Code Snippets+1

Type5Afe · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-1785

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code Snippets plugin for WordPress versions up to and including 3.9.4

Description The Code Snippets plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation on the cloud snippet download and update actions within the Cloud Search List Table class. This allows unauthenticated attackers to compel logged-in administrators to download or update cloud snippets without their knowledge, provided they can lure an administrator to a malicious webpage.

Recommendations Update the Code Snippets plugin to a version later than 3.9.4.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-1785

Produtos afetados

Code Snippets

Wordpress

Referências · 11

• https://github.com/codesnippetspro/code-snippets/pull/331/changes · Nota
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/list-table-shared-ops.php#L57 · Nota
• https://osv.dev/vulnerability/CVE-2026-1785 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-1785 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/class-cloud-search-list-table.php#L105 · Nota
• https://twitter.com/CVEnew/status/2019691690043244689 · Publicação no Twitter
• https://t.me/CVEtracker/43912 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/class-cloud-search-list-table.php#L105 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4a5787f3-6a16-491a-aa01-6222f275cf0f?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/list-table-shared-ops.php#L57 · Nota
• https://t.me/cveNotify/151107 · Publicação no Telegram