{"affected":[{"defaultStatus":"unaffected","product":"Code Snippets","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.1.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106468","cwes":["CWE-862"],"description":"The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/1f3a3a59-9c84-4bfc-97ee-2f19518ca1a7/"}],"kev":null,"metrics":[],"modifiedAt":1794376805477,"publishedAt":1794376805477,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/1f3a3a59-9c84-4bfc-97ee-2f19518ca1a7/"}],"remediation":[],"revision":"2cb35ea5d9a78a9602d1a8b709e5b53ddf23c00ea1129068229f8b131e90fb5f","sources":[{"modifiedAt":1794376805477,"name":"CNA: WPScan","retrievedAt":1794377307006,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106468"}],"ssvc":null,"status":"published","title":"Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import","updatedAt":1794377307006}