CVE-2026-106468
LOW
NVD
CVSS Score
3.8
Severity
LOW
Published
Nov 11, 2026
Vendor
unknown
Description
The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.