CVE-2026-101301

MediumCVSS 5.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Summary

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode. This allows unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

Risk Assessment

An attacker could temporarily disable security features or other important snippets, potentially leading to site malfunction or security breach.

Recommendation

Update the WPCode plugin to version 2.4.0 or later, which includes a fix for request verification.

Other vulnerabilities in WPCode WordPress plugin

CVE-2023-3524Medium
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting vulnerability.

Original NVD description (English source)

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS