CVE-2026-110002: Snazzy Social Media Feed RCE Vulnerability

CVE-2026-110002 Overview

CVE-2026-110002 is an arbitrary file upload vulnerability in the Snazzy Social Media Feed plugin for WordPress, affecting all versions up to and including 2.5. The flaw resides in the standalone save-to-cache.php script, which is reachable without loading the WordPress bootstrap. Because the script lacks authentication, capability, and nonce checks, authenticated attackers with subscriber-level access can write attacker-controlled PHP into cached-content/cached-feed.php. That file is immediately executable through a single GET request, enabling remote code execution [CWE-434].

Critical Impact
Authenticated subscribers can achieve remote code execution on the underlying WordPress host by writing a PHP payload into a web-accessible cache file.

Affected Products

WordPress Snazzy Social Media Feed plugin (slug: snazzy-cacheable-facebook-feed)
All plugin versions up to and including 2.5
WordPress sites allowing subscriber-level registration or higher

Discovery Timeline

2026-10-14 - CVE-2026-110002 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110002

Vulnerability Analysis

The vulnerable component is functions/save-to-cache.php, a PHP script shipped with the plugin and directly reachable over HTTP. The script does not include wp-load.php and therefore does not inherit WordPress authentication, capability, or nonce enforcement. Attackers reach the endpoint by requesting its path under the plugin directory and supplying a pluginURL parameter. The script writes that value into cached-content/cached-feed.php and returns control, leaving a web-executable PHP file on disk.

Root Cause

The root cause is twofold. First, the script bypasses the WordPress security model by executing outside the normal request lifecycle. Second, the only sanitization applied to the pluginURL input is PHP's FILTER_SANITIZE_URL, which preserves characters such as <, ?, =, (, ), and ; that are required to craft a valid PHP payload. Combined, these defects allow unsanitized attacker input to be concatenated into a PHP file and persisted to the webroot.

Attack Vector

An attacker registers or authenticates as a subscriber, then issues an HTTP request to the plugin's save-to-cache.php endpoint with a crafted pluginURL value containing PHP tags and payload code. The server writes cached-content/cached-feed.php containing the attacker's PHP. A follow-up GET request to that cached file executes the payload under the web server account, yielding remote code execution. See the Wordfence Vulnerability Analysis and the plugin source references at line 70, line 311, line 315, and line 328 for the specific sinks involved.

Detection Methods for CVE-2026-110002

Indicators of Compromise

Presence or recent modification of wp-content/plugins/snazzy-cacheable-facebook-feed/cached-content/cached-feed.php with PHP constructs not matching legitimate cached feed markup.
HTTP requests in access logs to /wp-content/plugins/snazzy-cacheable-facebook-feed/functions/save-to-cache.php originating from low-privilege or newly registered accounts.
Subsequent GET requests to cached-content/cached-feed.php returning unexpected content lengths or shell output.
New administrator accounts, modified WordPress options, or outbound connections from the www-data or PHP-FPM process shortly after cache writes.

Detection Strategies

Alert on writes to any .php file beneath wp-content/plugins/snazzy-cacheable-facebook-feed/cached-content/ using file integrity monitoring.
Inspect web server logs for POST or GET requests to save-to-cache.php that include pluginURL values containing <?php, system(, eval(, or base64-encoded strings.
Correlate subscriber-level session activity with filesystem writes under plugin directories.

Monitoring Recommendations

Enable WordPress audit logging for user registration, role changes, and plugin activity.
Forward web server, PHP-FPM, and file integrity events to a centralized analytics platform for correlation.
Monitor outbound network connections initiated by the webserver process to detect post-exploitation callbacks.

How to Mitigate CVE-2026-110002

Immediate Actions Required

Deactivate and remove the Snazzy Social Media Feed plugin until a fixed version is confirmed by the vendor.
Audit all WordPress user accounts and remove unused subscriber-level accounts; disable open registration where feasible.
Inspect cached-content/cached-feed.php and surrounding directories for attacker-written PHP and remove any suspicious artifacts.
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected.

Patch Information

At the time of publication, no fixed version is identified in the available advisory data for versions beyond 2.5. Monitor the Wordfence advisory and the plugin's WordPress.org page for an official patched release. Until a patched version is published, treat the plugin as unsafe to run.

Workarounds

Block external access to wp-content/plugins/snazzy-cacheable-facebook-feed/functions/save-to-cache.php at the web server or WAF layer.
Deny PHP execution within the plugin's cached-content/ directory via server configuration.
Restrict new user registration or require administrator approval to limit the attacker's ability to obtain the required subscriber role.

bash

# Apache: deny PHP execution in the plugin cache directory
# Place in: wp-content/plugins/snazzy-cacheable-facebook-feed/cached-content/.htaccess
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

# Nginx: block direct access to the vulnerable endpoint
location ~* /wp-content/plugins/snazzy-cacheable-facebook-feed/functions/save-to-cache\.php$ {
    deny all;
    return 403;
}

# Nginx: prevent PHP execution inside the cache directory
location ~* /wp-content/plugins/snazzy-cacheable-facebook-feed/cached-content/.*\.php$ {
    deny all;
    return 403;
}