CVE-2026-2723

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2723", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-18T21:26:57.839Z", "datePublished": "2026-03-21T03:27:09.562Z", "dateUpdated": "2026-04-08T17:27:08.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:08.432Z"}, "affected": [{"vendor": "phy9pas", "product": "Post Snippits", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L77"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L77"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-03-20T15:15:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:28:43.006450Z", "id": "CVE-2026-2723", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:28:54.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2723", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:28:43.006450Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:28:48.834Z"}}], "cna": {"title": "Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "phy9pas", "product": "Post Snippits", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:15:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L77"}, {"url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L77"}], "descriptions": [{"lang": "en", "value": "The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:08.432Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2723", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:08.432Z", "dateReserved": "2026-02-18T21:26:57.839Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:09.562Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Post Snippits", "vendor": "phy9pas", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Post Snippits para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en los manejadores de la p\u00e1gina de configuraci\u00f3n para guardar, a\u00f1adir y eliminar fragmentos. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin e inyecten scripts maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-2723", "lastModified": "2026-06-17T10:31:36.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2723", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T16:28:43.006450Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:17:12.387", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L55"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L71"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/tags/1.0/post-snippits.php#L77"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L55"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L71"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-snippits/trunk/post-snippits.php#L77"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Post Snippits", "source": "cna", "vendor": "phy9pas"}, "product": "post_snippits", "vendor": "phy9pas"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:36:55.977116+00:00", "value": {"mitigation_remediation": ["Update Post Snippits to the latest version that includes nonce validation on the settings page handlers.", "If an update is not available, uninstall or disable the Post Snippits plugin to eliminate the potential for CSRF and stored XSS.", "Verify that the plugin\u2019s settings endpoints no longer accept POST requests without a valid nonce or from unauthenticated users, using a local test or a security plugin."], "summary": {"action": "Immediate Patch", "impact": "Stored XSS via CSRF in Post Snippits"}, "threat_synthesis": {"affected_systems": "Affected systems are WordPress sites running the phy9pas Post Snippits plugin with version number 1.0 or older. The vulnerability exists across all supported platforms that host WordPress plugins but is limited to installations where the plugin is active.", "description_and_impact": "The Post Snippits plugin for WordPress versions up to and including 1.0 contains a missing nonce check on several settings page handlers, making it vulnerable to Cross Site Request Forgery. An unauthenticated attacker can submit a forged request to the plugin\u2019s settings, alter configuration values, or insert malicious HTML or JavaScript that is stored by the plugin. Once a site administrator follows a malicious link or clicks a crafted button, the injected script can execute in the context of the admin\u2019s browser, allowing for defacement, credential theft, or further drive\u2011by attacks.", "risk_and_exploitability": "The vulnerability scores a CVSS base score of 6.1, indicating moderate severity. Exploitability requires the user to be an administrator who accepts a crafted link; the attacker does not need direct access to the server, but must lure a site owner to the site. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the overall risk is moderate with limited publicly known exploitation. Nonetheless, any successful exploitation results in stored cross site scripting, which can compromise user sessions and data."}}}}, "created": "2026-03-23T09:49:50.690475+00:00", "updated": "2026-03-25T14:41:30.512212+00:00", "vendors": ["phy9pas", "phy9pas$PRODUCT$post_snippits", "wordpress", "wordpress$PRODUCT$wordpress"]}