CVE-2026-110002

Summary

The Snazzy Social Media Feed plugin allows authenticated attackers to upload arbitrary files that can be executed immediately, enabling remote code execution through a vulnerable standalone script without WordPress bootstrap.

Exploitability

Exploitation is straightforward for authenticated users with subscriber-level access or higher, requiring only a single GET request to execute uploaded PHP payloads via the cached feed file.

Blast radius

The vulnerability could lead to full server compromise if attackers upload malicious PHP files, potentially affecting all websites using the vulnerable plugin version and allowing lateral movement within the WordPress environment.

Detection

Monitor for unusual file creation in cached-content directory, particularly .php files written by save-to-cache.php script, and look for GET requests targeting cached-feed.php with suspicious payloads.

Prioritized remediation

Upgrade to version 2.590 or later to address this arbitrary file upload vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.