An unauthenticated attacker can disable automatically inserted code snippets for their own requests by bypassing the login page check in the WPCode plugin.
Affected component: WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager (plugin)
Fixed in: 2.4.0
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 25, 2026. No PowerSEC firewall rule blocks this attack. Update to 2.4.0 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-101301