CVE-2026-1785: XSRF in Code Snippets WordPress Plugin

An attacker exploiting this XSRF vulnerability could craft a malicious web page designed to trick an administrator into unknowingly executing actions within the Code Snippets plugin. Specifically, the attacker could force the administrator to download or update cloud snippets, potentially introducing malicious code or configurations into the WordPress environment. This could lead to unauthorized code execution, data breaches, or compromise of the entire WordPress site. The impact is amplified if the administrator has broad permissions, as the attacker could then leverage the plugin to perform actions with elevated privileges.

1. Reserved2026-02-02
2. Published2026-02-06
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1785 is to immediately upgrade the Code Snippets plugin to version 3.9.5 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing stricter input validation and output encoding practices within the plugin's code to prevent XSRF attacks. Additionally, enabling a WordPress security plugin with XSRF protection can provide an additional layer of defense. Regularly review WordPress user permissions to ensure administrators only have the necessary access.

Active installs

1.0MKnown

Plugin rating