WordPress FluentSnippets plugin <= 10.50 - Cross Site Request Forgery (CSRF) Vulnerability

The CSRF vulnerability in FluentSnippets allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to unauthorized modification of code snippets, changes to plugin settings, or even the deletion of critical data. Because FluentSnippets is used to manage code, an attacker could potentially inject malicious code into the snippets, leading to further compromise of the WordPress site. The impact is particularly severe given the plugin's widespread use for code management within WordPress environments.

WordPress websites utilizing the FluentSnippets plugin, particularly those running older versions (0.0.0–10.50), are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "fluent-snippets/includes/class-fluent-snippets-admin.php" * | grep -i 'wp_safe_redirect'

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin.php?page=fluent-snippets | grep -i 'referer'

1. 2025-07-16Disclosure

   disclosure

1. Reservado2025-07-16
2. Publicada2025-07-16
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-54010 is to immediately upgrade FluentSnippets to version 10.50.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites. Review FluentSnippets settings for any overly permissive configurations that could exacerbate the vulnerability.