The Code Snippets WordPress plugin before version 3.10.0 does not perform a capability check on one of its snippet‑management actions and derives the network scope of the targeted snippet from the request instead of from the stored record. This flaw, driven by CWE‑862, allows an administrator of a single subsite on a multisite network to activate, deactivate, and re‑prioritise network‑scoped snippets that run across every site in the network. By exploiting this oversight, an attacker can modify network‑scoped code snippets that execute on all sites, potentially injecting malicious code, defacing content, or compromising confidentiality, integrity, and availability of the full multisite deployment.

The vulnerability affects the WordPress Code Snippets plugin, specifically any installations using versions earlier than 3.10.0. This includes multisite networks where each site may have its own administrators; a subsite administrator can alter snippets that belong to the network tier.

The vulnerability is readily exploitable on any multisite WordPress environment with the affected plugin, given that a legitimate administrator already exists. The CVSS score is 3.3, and the EPSS score is less than 1%, indicating low but non‑zero exploit probability. The impact is still significant, allowing alteration of network‑wide code, and the issue is not listed in CISA KEV.