Code Snippets <= 3.9.4 - Cross-Site Request Forgery para Ações de Download/Atualização de Snippets na Nuvem

An attacker exploiting this XSRF vulnerability could craft a malicious web page designed to trick an administrator into unknowingly executing actions within the Code Snippets plugin. Specifically, the attacker could force the administrator to download or update cloud snippets, potentially introducing malicious code or configurations into the WordPress environment. This could lead to unauthorized code execution, data breaches, or compromise of the entire WordPress site. The impact is amplified if the administrator has broad permissions, as the attacker could then leverage the plugin to perform actions with elevated privileges.

WordPress websites utilizing the Code Snippets plugin, particularly those with administrators who frequently interact with cloud snippets, are at risk. Shared hosting environments where multiple WordPress installations share the same server resources are also potentially more vulnerable, as an attacker could exploit the vulnerability on one site to impact others.

• wordpress / composer / npm:

grep -r 'Cloud_Search_List_Table' /var/www/html/wp-content/plugins/code-snippets/

• wordpress / composer / npm:

wp plugin list --status=all | grep 'code-snippets'

• wordpress / composer / npm:

curl -I <wordpress_site>/wp-content/plugins/code-snippets/ | grep -i 'X-XSRF-TOKEN'

1. 2026-02-06Disclosure

   disclosure

1. Reservado2026-02-02
2. Publicada2026-02-06
3. Modificada2026-04-08
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-1785 is to immediately upgrade the Code Snippets plugin to version 3.9.5 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing stricter input validation and output encoding practices within the plugin's code to prevent XSRF attacks. Additionally, enabling a WordPress security plugin with XSRF protection can provide an additional layer of defense. Regularly review WordPress user permissions to ensure administrators only have the necessary access.

Instalações ativas

1.0MConhecido

Avaliação do plugin