The WPCode plugin for WordPress, in versions 2.0.0 through 2.3.9, fails to verify that a request is genuinely intended for the login screen before activating its snippet safe mode. This oversight allows any unauthenticated visitor to trigger safe mode and disable all of the site’s automatically inserted snippets for their own requests, effectively altering the site’s behavior for that user. The impact is primarily functional disruption and potential delivery of altered content to the attacker, without granting broader system compromise.

WordPress sites that have the WPCode plugin enabled with a version earlier than 2.4.0 are affected. The vulnerability applies to any installation of the plugin within the 2.0.0–2.3.9 range, regardless of WordPress version. No specific operating system or infrastructure details are supplied.

The vulnerability is scored 5.3 on CVSS, indicating moderate severity, and it is not listed in the CISA KEV catalog. The EPSS score is not available, so exploitation probability is uncertain. The likely attack vector is a web-based request to the plugin’s endpoint, requiring no authentication. Because the flaw permits disabling snippets for the attacker’s session, it can be used to modify or suppress content delivered to the user without affecting other visitors.