{"id":"CVE-2026-106468","kind":"vulnerability","aliases":["CVE-2026-106468"],"related":[],"title":"Code Snippets WordPress plugin lets subsite admins alter network-wide snippets","description":"The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.","summary":"The Code Snippets WordPress plugin before 4.1.0 does not check network-level permissions on its snippet import routes in multisite installs. A subsite administrator without network rights can create, overwrite and deactivate snippets that run across the whole network.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["code-snippets","multisite","package","wordpress"],"not_affected_if":["code-snippets-4.1.0-or-later","single-site-install"],"how_to_check":"- Check the installed Code Snippets version in the plugins list or `wp plugin get code-snippets --field=version`\n- Confirm whether the site runs WordPress multisite (`wp core is-installed --network`)\n- Look for the plugin's network-wide snippets in Network Admin > Snippets","fix":"- Code Snippets: move to `4.1.0` or later (per the sources, versions before 4.1.0 are affected)","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:02+00:00","updated_at":"2026-11-11T06:28:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:28:02Z","model":"claude-haiku-5-5","output":{"fix":"- Code Snippets: move to `4.1.0` or later (per the sources, versions before 4.1.0 are affected)","reach":"network","title":"Code Snippets WordPress plugin lets subsite admins alter network-wide snippets","impact":"high","summary":"The Code Snippets WordPress plugin before 4.1.0 does not check network-level permissions on its snippet import routes in multisite installs. A subsite administrator without network rights can create, overwrite and deactivate snippets that run across the whole network.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","multisite","code-snippets"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"subsite admin changes code running across the whole network","analyst_note":"Product ranges were not provided; confirm the affected version range and fixed version against the NVD or plugin changelog.,","how_to_check":"- Check the installed Code Snippets version in the plugins list or `wp plugin get code-snippets --field=version`\n- Confirm whether the site runs WordPress multisite (`wp core is-installed --network`)\n- Look for the plugin's network-wide snippets in Network Admin > Snippets","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-site-install","code-snippets-4.1.0-or-later"],"who_is_affected":"Only WordPress multisite networks running Code Snippets before 4.1.0 are exposed. The risk comes from subsite administrators who lack network-management rights, so single-site installs and networks where only trusted administrators hold subsite access can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4552,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106468':15A,18A '-2026':14A,17A '4.1.0':31B,71C 'across':61B 'admin':7A 'administr':49B,95C 'allow':93C 'alter':8A 'belong':114C 'capabl':78C 'check':34B 'code':1A,20B,26B,66C 'code-snippet':19B 'creat':54B,106C 'cve':13A,16A 'deactiv':57B,109C 'honour':80C 'import':42B,89C 'instal':46B 'let':5A 'level':37B,77C 'manag':103C 'multisit':22B,45B,92C 'network':10A,36B,51B,64B,76C,83C,102C,111C,118C 'network-level':35B,75C 'network-manag':101C 'network-scop':82C 'network-wid':9A,110C 'overwrit':55B,107C 'packag':23B 'paramet':85C 'permiss':38B 'plugin':4A,29B,69C 'right':52B,104C 'rout':43B,90C 'run':60B 'scope':84C 'singl':98C 'snippet':2A,12A,21B,27B,41B,58B,67C,88C,113C 'subsit':6A,48B,99C 'verifi':74C 'whole':63B,117C 'wide':11A,112C 'without':50B,100C 'wordpress':3A,24B,28B,68C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress multisite networks running Code Snippets before 4.1.0 are exposed. The risk comes from subsite administrators who lack network-management rights, so single-site installs and networks where only trusted administrators hold subsite access can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["codesnippets","medium","multisite","package","wordpress"],"campaign_type":null,"search_a":"'-106468':15A,18A '-2026':14A,17A 'admin':7A 'alter':8A 'code':1A 'cve':13A,16A 'let':5A 'network':10A 'network-wid':9A 'plugin':4A 'snippet':2A,12A 'subsit':6A 'wide':11A 'wordpress':3A","search_b":"'4.1.0':31B 'across':61B 'administr':49B 'check':34B 'code':20B,26B 'code-snippet':19B 'creat':54B 'deactiv':57B 'import':42B 'instal':46B 'level':37B 'multisit':22B,45B 'network':36B,51B,64B 'network-level':35B 'overwrit':55B 'packag':23B 'permiss':38B 'plugin':29B 'right':52B 'rout':43B 'run':60B 'snippet':21B,27B,41B,58B 'subsit':48B 'whole':63B 'without':50B 'wordpress':24B,28B","search_c":"'4.1.0':71C 'administr':95C 'allow':93C 'belong':114C 'capabl':78C 'code':66C 'creat':106C 'deactiv':109C 'honour':80C 'import':89C 'level':77C 'manag':103C 'multisit':92C 'network':76C,83C,102C,111C,118C 'network-level':75C 'network-manag':101C 'network-scop':82C 'network-wid':110C 'overwrit':107C 'paramet':85C 'plugin':69C 'right':104C 'rout':90C 'scope':84C 'singl':98C 'snippet':67C,88C,113C 'subsit':99C 'verifi':74C 'whole':117C 'wide':112C 'without':100C 'wordpress':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106468","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}