Key points
- All versions of the Snazzy Social Media Feed plugin up to and including 2.5 are affected by this arbitrary file upload flaw.
- The vulnerability carries a CVSS score of 9.8, rated as critical, and allows for remote code execution via a single request.
- Attackers require only subscriber-level access to exploit the missing security checks in the standalone cache script.
The Snazzy Social Media Feed plugin for WordPress contains a critical security flaw that permits authenticated users to upload executable files. This vulnerability affects all versions up to and including 2.5 and enables remote code execution on affected servers.
What happened
The National Vulnerability Database records CVE-2026-110002 as a critical issue with a CVSS score of 9.8. The flaw exists in the Snazzy Social Media Feed plugin for WordPress, specifically in versions up to and including 2.5. It stems from missing WordPress bootstrap, authentication, capability, and nonce checks within the standalone save-to-cache.php script.
This script is directly reachable without loading the main WordPress environment. It applies only FILTER_SANITIZE_URL to the pluginURL parameter, which preserves characters needed to craft valid PHP payloads. These payloads are written verbatim into cached-content/cached-feed.php, a web-executable file.
Why it matters
Authenticated attackers with subscriber-level access or higher can exploit this weakness to upload files that may be executable. This capability allows for remote code execution on the host server. The issue is classified under CWE-434 for unrestricted upload of executable file.
The vulnerability enables immediate execution of malicious code via a single GET request. Because the script bypasses standard WordPress security layers, even the lowest level of user access can lead to full system compromise. This poses a significant risk to any site using the affected plugin versions.
What happens next
- Verify if the Snazzy Social Media Feed plugin is installed on your WordPress instances.
- Check the current version number to determine if it is 2.5 or lower.
- Monitor vendor announcements for a patched version or temporary mitigation advice.
- Review server logs for unusual activity related to the save-to-cache.php script.
Patch priority
Security teams should prioritise systems where the affected plugin is active and accessible. Identify environments with subscriber-level user accounts that have recent activity. Test any available vendor updates in a staging environment before deployment to ensure compatibility with existing themes and other plugins. Back up site databases and files prior to making changes. If no fix is available, restrict access to the save-to-cache.php script via web server rules to limit exposure while awaiting a patch.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Snazzy Social Media Feed
- Audit all WordPress installations for the presence of the Snazzy Social Media Feed plugin.
- Confirm the installed version is not 2.5 or earlier to assess immediate risk.
- Review server access logs for requests targeting the save-to-cache.php script.
- Prepare to apply a vendor update once it becomes available to resolve the issue.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WordPress plugin is affected by CVE-2026-110002?
The Snazzy Social Media Feed plugin for WordPress is affected by this vulnerability.
What level of user access is required to exploit this flaw?
Attackers need authenticated access with subscriber-level permissions or above to exploit this issue.
Is there a fix available for this vulnerability?
The source material does not confirm that a patch or fix has been released yet.
