CVE-2026-106097 Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)
Subsite administrators can exploit SQL injection in Code Snippets to disclose network-wide credentials in WordPress Multisite environments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-106097?
CVE-2026-106097 is a medium-severity SQL injection vulnerability in Unknown Code Snippets, published on 9 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
Weakness: CWE-89
Which versions are affected by CVE-2026-106097?
How do I fix CVE-2026-106097?
No fix has been published for CVE-2026-106097 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-106097 being exploited?
There is no known exploitation of CVE-2026-106097 in the wild and no public exploit code.
Sources
Also known as GHSA-6xh4-5cg9-76mq.