Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110002— Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

Quick assessment

Affected
snazzyplugins Snazzy Social Media Feed
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件“Snazzy Social Media Feed”存在任意文件上传漏洞，影响所有低于或等于 2.5 的版本。该漏洞源于独立运行的 脚本中缺少必要的 WordPress 初始化加载、身份认证、权限校验以及非ce（nonce）验证机制，同时在对 参数写入可执行 PHP 文件之前， sanitization（清理/过滤）措施不足。这使得具备订阅者及以上权限的认证攻击者能够上传可能包含可执行代码的文件，从而导致远程代码执行（RCE）。 脚本可以直接访问，无需加载整个 WordPress 环境。尽管

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110002

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
snazzyplugins Snazzy Social Media Feed 0 ~ 2.5 -

II. Public POCs for CVE-2026-110002

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110002

请登录查看更多情报信息。

Other References for CVE-2026-110002 (5)

IV. Related Vulnerabilities

Same weakness: CWE-434

V. Comments for CVE-2026-110002

No comments yet

Leave a comment