CVE-2026-110002 is a critical (CVSS 9.8) arbitrary file upload flaw in the Snazzy Social Media Feed WordPress plugin through version 2.5. It can lead to remote code execution.
What Is It
CVE-2026-110002 is an arbitrary file upload vulnerability (CWE-434) in the plugin's standalone save-to-cache.php script. According to the advisory and the referenced source lines, the script can be reached directly without loading WordPress. It also appears to skip WordPress bootstrap, authentication, capability and nonce checks.
The advisory says the only filter applied to the pluginURL parameter is FILTER_SANITIZE_URL. That filter keeps the characters needed to build a valid PHP payload. The value is reportedly written unchanged into cached-content/cached-feed.php, where a single GET request can then run it.
The privilege level an attacker needs is unclear. Wordfence's description says attackers need subscriber-level access or higher. However, the CVSS vector it assigned marks Privileges Required as None, and the same description says the script has no authentication checks. Until this conflict is resolved, defenders should assume the exploitation path described above may work without authentication, and treat it as possibly needing at least a subscriber account.
Why It Matters
- Severity: CVSS 3.1 base score 9.8 (CRITICAL)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. As scored, it can be attacked over the network, has low complexity, needs no privileges and needs no user interaction. Impact on confidentiality, integrity and availability is high. The PR:N rating conflicts with the subscriber-level requirement in the advisory text. If subscriber access is actually required, the real-world score would be lower. - Impact: Successful exploitation writes attacker-controlled PHP to a file the web server will run, which allows remote code execution on the WordPress host.
CVE-2026-110002 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: snazzyplugins
- Product: Snazzy Social Media Feed (WordPress plugin; repository slug
snazzy-cacheable-facebook-feed) - Affected versions: All versions up to and including 2.5
- Affected component:
functions/save-to-cache.php, which writes tocached-content/cached-feed.php
Patch Status
The supplied NVD record does not list a fixed version. It was published on 2026-10-14 with status "Received" and has no CISA required action or remediation deadline.
Until a fixed release is confirmed, administrators running version 2.5 or earlier should check the Wordfence advisory for updates. They should also consider deactivating or removing the plugin. Because the privilege requirement is disputed, the safest approach is to treat exposed installations as reachable by unauthenticated attackers.