CVE-2026-106468

Name of the Vulnerable Software and Affected Versions Code Snippets WordPress plugin versions prior to 4.1.0

Description On multisite installations, the plugin fails to verify network-level capabilities before processing a network-scope parameter on its snippet import routes. This allows an administrator of a single subsite, who lacks network-management rights, to create, overwrite, and deactivate snippets that apply to the entire network.

Recommendations Update the Code Snippets WordPress plugin to version 4.1.0 or later.