CVE-2026-2723
Received Received - Intake

CSRF Vulnerability in Post Snippits Plugin Allows Settings Manipulation

Publication date: 2026-03-21

Last updated on: 2026-03-21

Assigner: Wordfence

Description
The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-21
Last Modified
2026-03-21
Generated
2026-07-06
AI Q&A
2026-03-21
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2723
EUVD
EUVD-2026-14152

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_snippits post_snippits to 1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Post Snippits plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This occurs because the plugin's settings page handlers for saving, adding, and deleting snippets do not validate nonces, which are security tokens used to verify requests. As a result, an attacker can trick a site administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts, by sending a forged request.

Impact Analysis

This vulnerability can allow unauthenticated attackers to modify the plugin settings and inject malicious scripts into the WordPress site. If an attacker successfully tricks a site administrator into clicking a malicious link, they can change how the plugin behaves or introduce harmful code, potentially compromising the security and integrity of the website.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2723. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart