The Code Snippets plugin for WordPress up to and including version 3.9.1 is vulnerable to PHP code injection. This occurs because the plugin uses extract() on attacker-controlled shortcode attributes in the evaluate_shortcode_from_flat_file method, allowing an authenticated user with Contributor-level access or higher to overwrite the $filepath variable. If an administrator enables the "Enable file-based execution" setting and creates an active Content snippet, the attacker can execute arbitrary PHP code via the [code_snippet] shortcode.