{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asnazzy_social_media_feed_projectsnazzy_social_media_feedwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:snazzy_social_media_feed_project:snazzy_social_media_feed:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110002"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Snazzy Social Media Feed (\u003c= 2.5)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","wordpress","cve-2026-110002","rce"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Snazzy Social Media Feed plugin for WordPress contains a critical vulnerability (CVE-2026-110002) affecting all versions up to and including 2.5. The flaw resides in the 'save-to-cache.php' file, which operates as a standalone script without the standard WordPress environment, authentication, capability checks, or nonce validation. An attacker with subscriber-level access or higher can exploit this by manipulating the 'pluginURL' parameter. Due to the use of 'FILTER_SANITIZE_URL', which fails to remove critical PHP syntax characters, the input is written directly into 'cached-content/cached-feed.php'. This allows an attacker to inject arbitrary PHP code, which is then immediately executable by requesting the file directly. This vulnerability provides a direct vector for remote code execution on the underlying web server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates as a user with subscriber-level privileges or higher on the target WordPress site.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious request containing a PHP payload designed to execute system commands.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST or GET request to the vulnerable endpoint: /wp-content/plugins/snazzy-social-media-feed/save-to-cache.php.\u003c/li\u003e\n\u003cli\u003eThe request includes the 'pluginURL' parameter containing the malicious PHP code disguised as a URL.\u003c/li\u003e\n\u003cli\u003eThe 'save-to-cache.php' script fails to validate the request or sanitize the input beyond 'FILTER_SANITIZE_URL', allowing the payload to pass.\u003c/li\u003e\n\u003cli\u003eThe script writes the malicious payload verbatim into the file 'cached-content/cached-feed.php'.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the malicious code by sending a GET request to the newly created 'cached-content/cached-feed.php' file.\u003c/li\u003e\n\u003cli\u003eThe web server executes the payload, granting the attacker arbitrary code execution privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an authenticated attacker to achieve full remote code execution on the web server. This could lead to a complete site compromise, data exfiltration, lateral movement within the hosting environment, and the installation of persistent backdoors. Given the ubiquity of WordPress installations, this vulnerability poses a significant risk to any organization running the affected plugin versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Snazzy Social Media Feed plugin to a version released after 2.5, if available.\u003c/li\u003e\n\u003cli\u003eIf no patch is available, deactivate and remove the Snazzy Social Media Feed plugin until a secure version is confirmed by the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous requests to 'save-to-cache.php' containing unusual 'pluginURL' parameters.\u003c/li\u003e\n\u003cli\u003eImplement strict file permissions on the WordPress 'plugins' and 'uploads' directories to prevent web-executable files from being created or executed.\u003c/li\u003e\n\u003cli\u003eUse WAF rules to block requests to '/wp-content/plugins/snazzy-social-media-feed/save-to-cache.php' unless explicitly required.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:35:28Z","date_published":"2026-10-14T04:35:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-snazzy-social-media-feed-rce/","summary":"The Snazzy Social Media Feed WordPress plugin (up to version 2.5) is susceptible to arbitrary file upload and remote code execution via insufficient sanitization in the standalone save-to-cache.php script.","title":"Arbitrary File Upload Vulnerability in Snazzy Social Media Feed Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-snazzy-social-media-feed-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:snazzy_social_media_feed_project:snazzy_social_media_feed:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}