The Snazzy Social Media Feed plugin allows an attacker to upload arbitrary files because the save-to-cache.php script lacks proper WordPress bootstrap, authentication, capability, and nonce checks. The pluginURL parameter is only sanitised with FILTER_SANITIZE_URL, which preserves characters that enable a PHP payload to be written verbatim to cached-feed.php. If an attacker can trigger the script, the saved file can be executed with a single GET request, giving remote code execution on the WordPress site.

WordPress sites that have the Snazzy Social Media Feed plugin installed and running versions 2.5 or earlier are vulnerable. The issue exists regardless of whether the plugin is enabled in the WordPress admin, because the vulnerable script is reachable directly without loading WordPress. Any site using the plugin in these versions could be targeted.

The CVSS score of 9.8 classifies this flaw as critical, reflecting the high impact of remote code execution. The EPSS score of less than 1% indicates that exploit attempts are relatively rare, but the severity remains high, and the vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker with subscriber‑level credentials can exploit the flaw by sending a crafted file upload to save-to-cache.php and then accessing the resulting cached-feed.php file, completing the attack from a single web request.