CVE-2026-106468

LowCVSS 3.8/10Last modified Nov 12, 2026

Description

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1064696.8The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and ins CVE-2026-106475.3The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet tra CVE-2026-1064705.0The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authentic CVE-2026-1064718.1A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated paramet CVE-2026-1064726.3Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it CVE-2026-1064757.1The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, CVE-2026-106485.5mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() bef CVE-2026-1064844.4Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrar CVE-2026-1064869.9Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-clou CVE-2026-1064875.0Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affecte CVE-2026-1064888.1Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider pack CVE-2026-1064896.5Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by