The Code Snippets WordPress plugin, any version prior to 3.10.0, contains a SQL injection flaw in its snippet‑migration import endpoints. Unsanitised user input is interpolated directly into an SQL query, allowing site administrators to craft UNION‑based payloads that can read data from shared network tables, including other users’ password hashes.

The flaw affects WordPress sites that employ the Code Snippets plugin with a version lower than 3.10.0. In a multisite environment, any subsite administrator who is not a network super administrator can access the vulnerable import endpoints and exploit the injection to obtain network‑wide data.

With a CVSS score of 6.8 and an EPSS score below 1%, the vulnerability is not listed in the CISA KEV catalog, yet it offers a moderate‑to‑high risk because it enables credential disclosure across the network. The exploit requires authentication as a site administrator; although no public exploit is documented, the low probability does not diminish the severity of potential data exposure.