CVE-2026-1785 is a CSRF vulnerability in the Code Snippets plugin for WordPress, affecting all versions up to and including 3.9.4. The issue arises from missing nonce validation in the Cloud_Search_List_Table class for cloud snippet download and update actions. This lack of proper request validation enables attackers to coerce authenticated administrators into executing these actions without their consent if they visit a maliciously crafted webpage. The vulnerability does not require privileges beyond a logged-in administrator and does not impact confidentiality or availability but can cause unauthorized modification of plugin snippets.

An attacker can cause logged-in WordPress administrators to unknowingly download or update cloud snippets in the Code Snippets plugin. This unauthorized modification could potentially introduce malicious code or disrupt expected plugin behavior. The vulnerability does not impact confidentiality or availability directly but affects integrity by allowing unauthorized changes. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted or suspicious websites while logged into WordPress with administrative privileges. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.