CVE-2026-106097 Details
Description
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
A SQL injection vulnerability has been identified in the Code Snippets WordPress plugin, affecting versions prior to 3.10.0. The issue arises because the plugin fails to properly sanitize and escape user-supplied parameters before incorporating them into SQL queries. This vulnerability is present in certain snippet-migration import endpoints, which can be accessed by any user with site administration privileges. In a WordPress Multisite network, this includes subsite Administrators. Exploitation of this vulnerability allows a subsite Administrator, who is not a network Super Admin, to execute UNION-based SQL injection attacks against shared network tables. As a result, they could disclose network-wide information, such as other users' password hashes.
Users are advised to update the Code Snippets WordPress plugin to version 3.10.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/f5206366-2e9c-42d5-90b9-ddfaf39aa02f/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Code Snippets | < 3.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |