CVE-2026-110002: CWE-434 Unrestricted Upload of File with Dangerous Type in snazzyplugins Snazzy Social Media Feed

CVE-2026-110002 is a critical arbitrary file upload vulnerability in the Snazzy Social Media Feed WordPress plugin affecting all versions up to 2.5. The issue stems from the save-to-cache.php script lacking WordPress bootstrap, authentication, capability, and nonce verification, combined with insufficient sanitization of the pluginURL parameter. This parameter is written verbatim into a PHP file (cached-content/cached-feed.php) that is immediately executable. Authenticated attackers with subscriber-level privileges can exploit this to upload malicious PHP code, resulting in remote code execution on the server.

Successful exploitation allows an attacker with low-level authenticated access to execute arbitrary PHP code remotely, leading to full compromise of the affected WordPress site. This includes potential data theft, site defacement, or further pivoting within the hosting environment. The CVSS 3.1 score of 9.8 reflects the critical severity due to network attack vector, low attack complexity, no privileges required beyond subscriber, and full confidentiality, integrity, and availability impact.

No official patch or fix is currently documented. Users should immediately restrict access to the save-to-cache.php script and consider disabling or removing the Snazzy Social Media Feed plugin until a vendor-provided fix is available. Monitor vendor advisories for updates. Since the script is directly accessible without WordPress context, applying web server access controls (e.g., deny direct access to this script) can mitigate exploitation risk temporarily.