CVE-2026-10195 in FS Poster Plugin
Summary
by MITRE • 09/01/2026
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The FS-Poster plugin for WordPress presents a critical security vulnerability in versions up to and including 8.0.1 that allows for Remote Code Execution by authenticated users. This flaw stems from two distinct but compounding deficiencies within the application's architecture: insufficient input sanitization of user-supplied data passed to system execution functions, and a complete absence of authorization checks on specific REST API endpoints. The combination of these issues creates an attack vector where even low-privileged accounts can escalate their capabilities significantly beyond what is intended by the software design.
The technical root cause lies in how the plugin handles the FFmpeg path parameter. When processing media files for conversion or streaming, the application constructs a command string that includes user-provided input regarding the location of the FFmpeg executable. This input is passed directly to PHP's exec() function without adequate validation or sanitization. Because the exec() function executes shell commands, any unsanthesized special characters such as semicolons, pipes, or backticks within the path parameter can be interpreted by the underlying operating system shell rather than treated as literal string data. This allows an attacker to inject arbitrary command-line arguments that are executed with the privileges of the web server process.
Compounding this input validation failure is a severe access control deficiency on the REST API endpoints associated with these media processing functions. Typically, operations involving system-level commands or file manipulation should be restricted to administrators or users with specific high-privilege roles. However, in vulnerable versions of FS-Poster, there are no authorization checks enforcing role-based restrictions on these endpoints. Consequently, any user account that can authenticate to the WordPress site, including those with subscriber-level access and above, is granted the ability to invoke these API methods. This lack of enforcement means that even users who should have minimal interaction capabilities can trigger the vulnerable code paths.
The operational impact of this vulnerability is severe, resulting in full Remote Code Execution on the host server. An attacker leveraging this flaw can execute arbitrary commands with the same permissions as the web server user, which often includes read and write access to all files within the WordPress installation directory and potentially broader system access depending on server configuration. This capability allows for complete compromise of the affected website, including theft of sensitive data such as database credentials, user information, and proprietary content. Furthermore, attackers can use this foothold to pivot into internal networks, install persistent backdoors, or deploy ransomware, turning a simple plugin vulnerability into a catastrophic infrastructure breach.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) due to the failure to sanitize input before shell execution. It also corresponds to CWE-269 Improvement of Privilege Control regarding the lack of proper authorization checks on API endpoints, allowing lower-privileged users to perform high-level actions. From a tactical perspective, this exploitation pattern is consistent with ATT&CK technique T1059 Command and Scripting Interpreter, specifically through OS command execution via web application interfaces.
Mitigation strategies must address both the input handling logic and the access control mechanisms immediately. The most effective remediation is to upgrade the FS-Poster plugin to a version that has patched these issues by implementing strict allow-list validation for file paths and enforcing role-based access controls on all REST API endpoints. Until an update is available, administrators should restrict web server permissions to limit write access outside of necessary directories and consider disabling or removing the vulnerable plugin if it is not essential to operations. Additionally, deploying a Web Application Firewall with rules capable of detecting OS command injection patterns in HTTP requests can provide a layer of defense against exploitation attempts targeting this specific flaw.