The Code Snippets plugin for WordPress contains a CSRF flaw that arises from missing nonce validation in the Cloud_Search_List_Table class. An attacker can use a crafted request to trigger the download or update of cloud snippets on a target administrator’s account. This allows the attacker to force the installation or replacement of code in the cloud snippet repository, potentially leading to unintended code execution or alteration of site functionality. The flaw does not provide direct code execution or privilege escalation on its own, but it undermines the integrity of the plugin’s managed code base.

WordPress installations running the Code Snippets plugin, version 3.9.4 or earlier. The affected package is distributed by codesnippetspro and includes the Cloud_Search_List_Table component. Administrators who have the plugin enabled are vulnerable unless the plugin is updated beyond the specified version.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is below 1 %, suggesting a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. An attacker would need to craft a malicious URL or page that forces an administrator’s browser to issue a request to the plugin’s cloud snippet endpoint. Because the attacker does not require any administrative credentials, the primary barrier is social engineering—getting the target to click a link or visit a crafted page.