PT-2026-6692 · WordPress · Code Snippets+1

Type5Afe · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-1785

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code Snippets plugin for WordPress versions up to and including 3.9.4

Description The Code Snippets plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation on the cloud snippet download and update actions within the Cloud Search List Table class. This allows unauthenticated attackers to compel logged-in administrators to download or update cloud snippets without their knowledge, provided they can lure an administrator to a malicious webpage.

Recommendations Update the Code Snippets plugin to a version later than 3.9.4.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-1785

Affected Products

Code Snippets

Wordpress

References · 11

• https://osv.dev/vulnerability/CVE-2026-1785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1785 · Security Note
• https://github.com/codesnippetspro/code-snippets/pull/331/changes · Note
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/list-table-shared-ops.php#L57 · Note
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/class-cloud-search-list-table.php#L105 · Note
• https://twitter.com/CVEnew/status/2019691690043244689 · Twitter Post
• https://t.me/CVEtracker/43912 · Telegram Post
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/class-cloud-search-list-table.php#L105 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4a5787f3-6a16-491a-aa01-6222f275cf0f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/list-table-shared-ops.php#L57 · Note
• https://t.me/cveNotify/151107 · Telegram Post