Arbitrary File Upload Vulnerability in Snazzy Social Media Feed Plugin

The Snazzy Social Media Feed plugin for WordPress contains a critical vulnerability (CVE-2026-110002) affecting all versions up to and including 2.5. The flaw resides in the 'save-to-cache.php' file, which operates as a standalone script without the standard WordPress environment, authentication, capability checks, or nonce validation. An attacker with subscriber-level access or higher can exploit this by manipulating the 'pluginURL' parameter. Due to the use of 'FILTER_SANITIZE_URL', which fails to remove critical PHP syntax characters, the input is written directly into 'cached-content/cached-feed.php'. This allows an attacker to inject arbitrary PHP code, which is then immediately executable by requesting the file directly. This vulnerability provides a direct vector for remote code execution on the underlying web server.

Attack Chain

1. Attacker authenticates as a user with subscriber-level privileges or higher on the target WordPress site.
2. Attacker crafts a malicious request containing a PHP payload designed to execute system commands.
3. Attacker sends an HTTP POST or GET request to the vulnerable endpoint: /wp-content/plugins/snazzy-social-media-feed/save-to-cache.php.
4. The request includes the 'pluginURL' parameter containing the malicious PHP code disguised as a URL.
5. The 'save-to-cache.php' script fails to validate the request or sanitize the input beyond 'FILTER_SANITIZE_URL', allowing the payload to pass.
6. The script writes the malicious payload verbatim into the file 'cached-content/cached-feed.php'.
7. Attacker triggers the malicious code by sending a GET request to the newly created 'cached-content/cached-feed.php' file.
8. The web server executes the payload, granting the attacker arbitrary code execution privileges.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to achieve full remote code execution on the web server. This could lead to a complete site compromise, data exfiltration, lateral movement within the hosting environment, and the installation of persistent backdoors. Given the ubiquity of WordPress installations, this vulnerability poses a significant risk to any organization running the affected plugin versions.

Recommendation

• Immediately update the Snazzy Social Media Feed plugin to a version released after 2.5, if available.
• If no patch is available, deactivate and remove the Snazzy Social Media Feed plugin until a secure version is confirmed by the vendor.
• Monitor web server access logs for anomalous requests to 'save-to-cache.php' containing unusual 'pluginURL' parameters.
• Implement strict file permissions on the WordPress 'plugins' and 'uploads' directories to prevent web-executable files from being created or executed.
• Use WAF rules to block requests to '/wp-content/plugins/snazzy-social-media-feed/save-to-cache.php' unless explicitly required.