CVE-2026-1785

The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.

• CWE-352

• https://github.com/codesnippetspro/code-snippets/pull/331/changes
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/class-cloud-search-list-table.php#L105
• https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.9.4/php/cloud/list-table-shared-ops.php#L57
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/class-cloud-search-list-table.php#L105
• https://plugins.trac.wordpress.org/browser/code-snippets/trunk/php/cloud/list-table-shared-ops.php#L57
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5787f3-6a16-491a-aa01-6222f275cf0f?source=cve

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17844Insufficient validation of untrusted input in Cast in Google…4.3
• CVE-2026-17845Inappropriate implementation in CSS in Google Chrome prior t…6.1
• CVE-2026-17846Inappropriate implementation in Media in Google Chrome on Wi…6.5
• CVE-2026-17847Insufficient validation of untrusted input in ANGLE in Googl…9.6
• CVE-2026-17848Integer overflow in Codecs in Google Chrome prior to 151.0.7…9.6
• CVE-2026-17849Inappropriate implementation in Chrome for iOS in Google Chr…4.3
• CVE-2026-17850Inappropriate implementation in Permissions in Google Chrome…6.5
• CVE-2026-17851Side-channel information leakage in Autofill in Google Chrom…4.3
• CVE-2026-17852Inappropriate implementation in Media Router in Google Chrom…6.5
• CVE-2026-17853Inappropriate implementation in DevTools in Google Chrome pr…6.1
• CVE-2026-17854Insufficient policy enforcement in WebMCP in Google Chrome p…6.5
• CVE-2026-17855Race in DevTools in Google Chrome on Mac prior to 151.0.7922…9.6