Threat database

The Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) contains an arbitrary file upload vulnerability due to insufficient validation in the save-to-cache.php script. This script lacks WordPress bootstrap, authentication, capability, and nonce checks, allowing authenticated users with subscriber-level access or higher to upload executable PHP files. The vulnerability arises because the pluginURL parameter is only filtered with FILTER_SANITIZE_URL, which does not prevent PHP payload injection. Uploaded PHP code is written to cached-content/cached-feed.php and can be executed via a GET request, enabling remote code execution.