CRITICAL
snazzyplugins
CVE published 2026-10-14
CVE-2026-110002
The Snazzy Social Media Feed plugin for WordPress has a critical vulnerability allowing unauthenticated arbitrary file uploads. This issue affects all versions up to and including 2.5, enabling attackers to upload potentially executable files, which could lead to remote code execution. The vulnerability stems from missing WordPress bootstrap, authentication, capability, and nonce checks in the save-to-cac [truncated]