CVE-2026-110002 snazzyplugins CVE debrief

Who should care

WordPress administrators, security teams, and users of the Snazzy Social Media Feed plugin should assess exposure and prioritize remediation. This vulnerability is a high priority for immediate assessment and remediation due to the potential for remote code execution and unauthenticated arbitrary file uploads.

Why it matters

CVE-2026-110002 is a critical vulnerability in the Snazzy Social Media Feed plugin for WordPress, allowing unauthenticated arbitrary file uploads. This could lead to remote code execution, making it a high priority for immediate assessment and remediation by WordPress administrators and security teams.

• Possible remote code execution
• Unauthenticated arbitrary file uploads
• Bypassing of WordPress security checks
• Potential for malicious file execution

Technical summary

The Snazzy Social Media Feed plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient checks in the save-to-cache.php script. This allows unauthenticated attackers to upload potentially executable files, enabling remote code execution. The vulnerability arises from the script's lack of WordPress bootstrap, authentication, capability, and nonce checks, along with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This issue affects all versions up to and including 2.5.

Defensive priority

High priority for immediate assessment and remediation

Recommended defensive actions

• Immediately update Snazzy Social Media Feed plugin to a version beyond 2.5 if available
• Restrict access to the save-to-cache.php script
• Monitor for suspicious file uploads and system changes
• Implement additional security measures such as web application firewalls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the save-to-cache.php script. Insufficient sanitization of the pluginURL parameter allows it to be written to a web-executable PHP file. The FILTER_SANITIZE_URL filter applied to the pluginURL value preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request. This issue has been confirmed in versions up to and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.