The WPCode WordPress plugin, from versions 2.0.0 to 2.3.9, does not confirm that a request truly targets the login screen before activating snippet safe mode. This defect lets any unauthenticated visitor trigger safe mode, disabling all automatically inserted snippets for their own HTTP requests. Consequently, the attacker can alter or suppress content delivered to their browser, though no wider system compromise is granted.

WordPress sites running the WPCode plugin version 2.0.0 through 2.3.9 are affected. The description does not specify any dependencies on the WordPress core version or on operating system or infrastructure. Therefore, the vulnerability applies to all installations of the plugin regardless of those factors.

The CVSS score of 5.3 categorizes the issue as moderate severity. The EPSS score of 0.00257 indicates a very low exploitation probability. The typical attack path involves a web‑based request to the plugin’s safe‑mode endpoint, requiring no authentication. The flaw allows an attacker to modify or suppress content for their session without impacting other visitors, and it is not listed in CISA's KEV catalog.