CVE-2026-106468: Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import

Q: Which deployments are affected?

The issue affects WordPress multisite deployments using Code Snippets versions before 4.1.0. It concerns network-wide snippets; a single-site WordPress installation is not described as affected.

Q: What level of access does an attacker need?

An attacker needs administrator access to a subsite in the multisite network. Network-management privileges are not required.

Q: What could a subsite administrator do?

They can use the snippet import routes with a network-scope parameter to create, overwrite, or deactivate snippets that apply across the entire network.

Q: How can I determine whether my network is exposed?

Check whether the site is a WordPress multisite deployment and whether Code Snippets is earlier than version 4.1.0. Also review whether subsite administrators have access to the plugin's snippet import functionality.

Q: What is the available remediation?

Update Code Snippets to version 4.1.0 or later. The provided information does not specify a workaround for environments where updating is not immediately possible.

Published Nov 11, 2026

Updated

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.

Affected Software

1 affected component

Code Snippets Code Snippets<4.1.0

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which deployments are affected?

The issue affects WordPress multisite deployments using Code Snippets versions before 4.1.0. It concerns network-wide snippets; a single-site WordPress installation is not described as affected.

What level of access does an attacker need?

An attacker needs administrator access to a subsite in the multisite network. Network-management privileges are not required.

What could a subsite administrator do?

They can use the snippet import routes with a network-scope parameter to create, overwrite, or deactivate snippets that apply across the entire network.

How can I determine whether my network is exposed?

Check whether the site is a WordPress multisite deployment and whether Code Snippets is earlier than version 4.1.0. Also review whether subsite administrators have access to the plugin's snippet import functionality.

What is the available remediation?

Update Code Snippets to version 4.1.0 or later. The provided information does not specify a workaround for environments where updating is not immediately possible.

CVE-2026-106468: Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could a subsite administrator do?

How can I determine whether my network is exposed?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could a subsite administrator do?

How can I determine whether my network is exposed?

What is the available remediation?