Snazzy Social Media Feed Plugin Flaw Enables Remote Code Execution
A critical vulnerability in the Snazzy Social Media Feed plugin allows low-privilege users to upload executable files and run arbitrary code on WordPress sites.
Key points
- The flaw affects all versions of the Snazzy Social Media Feed plugin up to and including version 2.5.
- Attackers need only subscriber-level access to exploit the missing security checks in the save-to-cache.php script.
- The vulnerability is rated Critical with a CVSS score of 9.8 due to the potential for remote code execution.
The Snazzy Social Media Feed plugin for WordPress contains a severe security flaw that permits authenticated users with minimal permissions to execute remote code. According to the National Vulnerability Database, the issue stems from insufficient validation in a standalone script that processes social media data. This weakness allows attackers to bypass standard WordPress security controls entirely.
The risk
The vulnerability, identified as CVE-2026-110002, is classified as Critical with a CVSS score of 9.8. It arises because the save-to-cache.php script operates independently of the main WordPress bootstrap process. Consequently, it lacks essential authentication, capability, and nonce checks that normally protect user inputs. This isolation creates a direct path for exploitation.
An attacker can exploit this by manipulating the pluginURL parameter. The script applies only a basic FILTER_SANITIZE_URL filter, which fails to strip characters necessary for crafting PHP payloads. These malicious inputs are written directly into the cached-content/cached-feed.php file. This file is web-executable and runs immediately upon a single GET request, enabling arbitrary file upload and code execution.
Who is exposed
Any WordPress site running the Snazzy Social Media Feed plugin in version 2.5 or earlier is vulnerable. The threat model is particularly concerning because it does not require administrative privileges. According to the NVD record, any authenticated user with subscriber-level access or higher can trigger the exploit. This includes standard blog commenters or registered users with minimal roles.
Cost and compliance
The source material does not provide specific data regarding financial losses, regulatory fines, or compliance impacts resulting from this vulnerability. No information is available in the provided records about whether organizations have faced penalties or incurred costs due to exploitation of this specific flaw.
What to watch
Site administrators should immediately audit their WordPress installations for the Snazzy Social Media Feed plugin. Teams must verify the installed version and compare it against the vulnerable range ending at 2.5. Monitoring server logs for unusual file creation or execution patterns in the cached-content directory is also advisable.
Signals worth monitoring
Security teams typically look for anomalies in web server access logs that indicate unauthorized file uploads or unusual POST requests to known plugin scripts. Defenders often check for the creation of new PHP files in directories that should only contain static cache data. Incident responders usually isolate affected servers to prevent lateral movement while investigating the source of the malicious payload.
Background: File upload vulnerabilities
Reject files based on MIME type and content inspection at the server level. Store uploads outside the web root with random filenames. Disable execution permissions for upload directories to prevent code injection.
Read the full guide: Stop File Upload Vulnerabilities with Server-Side Controls
What to do and how to stay safe: Snazzy Social Media Feed
- Inventory all WordPress sites and identify those running the Snazzy Social Media Feed plugin.
- Check the installed version against the vulnerable range; update to a patched version if available.
- Monitor server logs for unexpected file uploads or execution attempts in plugin directories.
- Restrict file permissions on web directories to limit the impact of potential unauthorized writes.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-110002?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.
Which versions of the plugin are affected?
All versions of the Snazzy Social Media Feed plugin up to and including version 2.5 are vulnerable.
What level of access is required to exploit this flaw?
An attacker needs authenticated access with subscriber-level privileges or higher to exploit the vulnerability.
