Key points
- The flaw affects all versions of the Snazzy Social Media Feed plugin up to and including version 2.5.
- Attackers need only a subscriber-level account to exploit the vulnerability and achieve remote code execution.
- The issue stems from an unprotected script that writes unsanitized data directly into executable PHP files.
The Snazzy Social Media Feed plugin for WordPress presents a severe risk to site owners, as it allows remote code execution through an arbitrary file upload flaw. According to the National Vulnerability Database record for CVE-2026-110002, this vulnerability is rated Critical with a CVSS score of 9.8. The issue exists in all versions of the plugin up to and including version 2.5.
In plain English
The problem arises because a specific script within the plugin, save-to-cache.php, operates independently of the main WordPress security framework. This script lacks essential checks for authentication, user capabilities, and nonce validation. Consequently, it does not verify whether the person using it is authorised to perform sensitive actions.
The background
When the script processes data, it accepts a parameter called pluginURL. The only protection applied is a basic filter that fails to remove characters necessary for crafting malicious PHP code. This unsanitized input is then written directly into a file named cached-feed.php, which the web server treats as executable code.
What changes now
An attacker with any account level, including the lowest subscriber role, can trigger this flaw. By sending a specially crafted request, they can upload executable files to the server. These files become active immediately and can be run via a simple web request, granting the attacker full control over the affected WordPress installation.
The attacker's path
Teams usually monitor for unusual file creation events in plugin directories. Check whether scripts run outside the main application framework are properly secured. Verify that all inputs are validated before being written to disk. Ensure that authentication checks are enforced on every entry point. Confirm that caching mechanisms do not store executable content derived from user input. Review access logs for requests to unexpected endpoints.
Background: File upload vulnerabilities
Monitor for unexpected MIME types, rapid sequential uploads, and execution attempts from storage directories. Combine server-side validation with strict content-type checking. Review file naming patterns for double extensions. Use automated scanning to find misconfigurations that allow script execution in upload folders.
Read the full guide: Detect File Upload Vulnerabilities: Log Signals and Blind Spots
What to do and how to stay safe: Snazzy Social Media Feed
- Audit all installed WordPress plugins for versions prior to the next release or confirmed patch.
- Remove unnecessary user accounts, particularly those with subscriber or lower-level access.
- Monitor server file systems for new PHP files created in plugin cache directories.
- Restrict direct access to plugin script files via web server configuration rules.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect the latest version of Snazzy Social Media Feed?
Yes, the flaw affects all versions up to and including version 2.5, according to the NVD record.
What level of access does an attacker need to exploit this flaw?
An attacker needs an authenticated account with subscriber-level access or higher to trigger the exploit.
Is there a confirmed fix available for CVE-2026-110002?
No fix has been confirmed yet in the provided source material; users should monitor for vendor updates.
