CVE-2026-106097
Medium
Description
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
SeverityMedium
CVSS6.8
Exploit probability—
ProductCode Snippets
PublishedOct 9, 2026
First seenOct 9, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- Code Snippets3.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Code Snippets | v < 3.10.0 | 3.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.