CVE-2026-106095

{
  "etk_id": "ETK-2026-2238",
  "cve_id": "CVE-2026-106095",
  "display_id": "CVE-2026-106095",
  "ghsa_id": "GHSA-x27w-vpmw-g569",
  "euvd_id": "EUVD-2026-95506",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization for network snippets in Code Snippets",
  "summary": "Code Snippets versions before 3.10.0 on WordPress multisite installations are affected. An administrator of one subsite can change the enabled state or ordering of snippets configured for the entire network, potentially affecting every site; the attacker must already hold subsite administrator access.",
  "mitigation": "Update Code Snippets to version 3.10.0 or later. Until updated, restrict untrusted users from holding administrator roles on subsites in multisite networks.",
  "vendor": null,
  "product": "Code Snippets",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.10.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.10.0"
      ],
      "package_name": "Code Snippets",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 3.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.009373166666666667,
  "t0_at": "2026-10-09T06:00:08.896000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T23:14:31.967615+00:00",
      "days": 11.718322588136575,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T06:00:08.896000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T06:00:08.896000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T06:00:08.896000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106095"
    }
  }
}