# CVE-2026-56049: Post Snippets Remote Code Execution in WordPress Plugin

Source: https://junglewise.ai/threats/cve-2026-56049-post-snippets-remote-code-execution-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-56049 · Severity: high · CVSS 8.5 · Published 2026-06-25

Post Snippets is a WordPress plugin that allows users to create and manage reusable code fragments for their websites. A security flaw in versions 4.0.19 and earlier allows users with 'Contributor' level access to execute unauthorized code on the server. This could lead to a complete takeover of the website, data theft, or the installation of persistent backdoors.

Technologies: [Post Snippets](https://junglewise.ai/threats/technologies/post-snippets). Vendors: [Post Snippets](https://junglewise.ai/threats/vendors/post-snippets).

## Quick answers

**Is CVE-2026-56049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56049 being exploited in the wild.

**How severe is CVE-2026-56049?** High severity, with a CVSS score of 8.5, published 25 June 2026.

**Which products and versions are affected?** Post Snippets <= 4.0.19.

**Is there a fix for CVE-2026-56049?** A patch was published on 2026-06-25: Patch released in version 4.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56049 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56049?** Check whether you run Post Snippets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Remote Code Execution (RCE) vulnerability exists in the Post Snippets plugin for WordPress (versions up to 4.0.19) due to improper control of code generation (CWE-94). The flaw allows an attacker with 'Contributor' or higher privileges to inject and execute arbitrary PHP code on the server. While the attack requires network access and specific user privileges, the impact is critical as it allows for full system compromise and bypasses security boundaries (Scope: Changed). The issue is resolved in version 4.1.0.

## Affected products

- Post Snippets Post Snippets <= 4.0.19

## Timeline

- 2026-04-27: other: Vulnerability reported by researcher daroo
- 2026-06-25: disclosed: Public disclosure of CVE-2026-56049
- 2026-06-25: patched: Patch released in version 4.1.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-19-remote-code-execution-rce-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/post-snippets/vulnerability/wordpress-post-snippets-plugin-4-0-19-remote-code-execution-rce-vulnerability?_s_id=cve)

## Related threats

- [Post Snippets WordPress plugin stored XSS via snippet variables](https://junglewise.ai/threats/cve-2026-12980-the-post-snippets-wordpress-plugin-through-4-2-4-does-not)
- [Post Snippets WordPress plugin Stored XSS in WPEditor.php](https://junglewise.ai/threats/cve-2026-7430-post-snippets-wordpress-plugin-stored-xss-in-wpeditor-php)