Snazzy Social Media Feed WordPress Plugin: Critical CVE-2026-110002

Snazzy Social Media Feed WordPress Plugin: Critical CVE-2026-110002

What CVE-2026-110002 is and who is affectedThe National Vulnerability Database (NVD) of NIST has published CVE-2026-110002, an arbitrary file upload f...

What CVE-2026-110002 is and who is affected

The National Vulnerability Database (NVD) of NIST has published CVE-2026-110002, an arbitrary file upload flaw (CWE-434) in the Snazzy Social Media Feed plugin for WordPress. According to the NVD entry, all versions up to and including 2.5 are affected. The issue sits in the plugin's standalone save-to-cache.php script: it is directly reachable without loading WordPress, and it lacks the usual WordPress bootstrap, authentication, capability and nonce checks. The pluginURL parameter is written into a web-executable PHP file after only a FILTER_SANITIZE_URL pass, which preserves the characters needed to craft a valid PHP payload.

Cracked padlock beside an open parcel box on a tiled floor, symbolising a critical file upload vulnerability in a WordPress plugin

NVD rates it CVSS 3.1 9.8, CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice, the NVD description states that authenticated attackers with subscriber-level access and above can upload files that may be executable, which makes remote code execution possible. The payload is written verbatim into cached-content/cached-feed.php and, according to the description, becomes immediately executable through a single GET request. Any Spanish pyme, online shop or organisation running this plugin on a WordPress site is in scope, whether the site sits on shared hosting in Barcelona, a VPS in Lleida or a server managed by a small internal IT team.

Why it is urgent, even without KEV listing

As of the NVD publication date, 14 October 2026, CVE-2026-110002 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record that it is being exploited in real attacks. That is a reason to act before it appears there, not a reason to wait. The combination of a critical score, network reachability, low attack complexity and no user interaction means a single crafted request can turn a low-privilege account into code execution on the server. On shared hosting, that can expose neighbouring sites; on a company server, it can expose databases, customer records and connected internal services, with GDPR implications if personal data is reached.

What to do today

  • Check whether the plugin is installed and which version is running. In WordPress, review the Plugins screen or the plugin file headers. If Snazzy Social Media Feed is present at version 2.5 or below, treat it as exposed.
  • Apply the fix indicated by the vendor's advisory. The NVD entry does not state which version corrects the flaw, so follow the plugin vendor's official guidance and update to whatever release it designates. If no fixed version is available yet, consider deactivating and removing the plugin until one is published.
  • Look for signs of intrusion. Check for unexpected files under cached-content/, especially cached-feed.php, and review the web server logs for direct requests to save-to-cache.php that bypass the normal WordPress entry points. Unusual subscriber accounts, new administrator users or outbound connections from the server also deserve a look.
  • Reduce what is exposed to the internet. Restrict access to plugin scripts where possible, keep WordPress core, themes and plugins patched, and make sure file permissions prevent the web server from writing executable PHP in upload or cache directories.

How a cybersecurity team such as ALMC's can help

Stories like CVE-2026-110002 are rarely isolated: they surface because a plugin, a theme or a server component was not tracked closely enough. At ALMC we work with pymes, ecommerce businesses and small IT teams across Catalonia on exactly this problem. We run security audits and pentesting to find vulnerabilities before attackers do, harden servers and WordPress, PrestaShop and Joomla installations, and keep them updated with the patches that matter. When something does go wrong, we handle incident response and repair hacked websites, then close the gap that allowed it. If your team is small and your exposure is large, that is the point at which an external pair of hands tends to pay for itself.

Related

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.