Remote Code Execution in FS-Poster WordPress Plugin (CVE-2026-10195)

The FS-Poster plugin for WordPress is affected by a critical vulnerability, tracked as CVE-2026-10195, which enables Remote Code Execution (RCE). The flaw exists due to a combination of insufficient input sanitization of the FFmpeg path configuration parameter and a total lack of authorization checks on specific REST API endpoints. This vulnerability allows an authenticated attacker with a subscriber-level account - a common privilege level for registered users on many WordPress sites - to inject arbitrary commands that are subsequently processed by the server-side exec() function. This issue affects all versions of the plugin up to and including 8.0.1. Because the plugin interfaces directly with system binaries like FFmpeg, successful exploitation grants the attacker the execution context of the web server process (e.g., www-data), potentially leading to site takeover, data exfiltration, or further lateral movement within the hosting environment.

Attack Chain

1. Attacker registers an account or uses an existing subscriber-level account on the target WordPress site.
2. Attacker performs discovery to identify active plugins and confirms the presence of FS-Poster via public-facing path disclosures or theme assets.
3. Attacker authenticates to the WordPress site to obtain a valid session cookie and nonces required for API interaction.
4. Attacker crafts a malicious HTTP POST request targeting the vulnerable FS-Poster REST API endpoint.
5. Attacker injects shell metacharacters (e.g., ;, &&, |) into the FFmpeg path parameter within the REST request payload.
6. The plugin fails to validate or sanitize the FFmpeg path input before passing it to the PHP exec() system call.
7. The underlying web server process executes the injected commands with the privileges of the web service account.
8. Attacker achieves command execution to download web shells, reverse shells, or exfiltrate configuration files.

Impact

Successful exploitation of CVE-2026-10195 permits authenticated attackers to execute arbitrary system commands on the WordPress server. This impact is significant for organizations hosting sensitive content, user data, or those using the WordPress instance as an entry point into a larger corporate network. Given that many WordPress sites allow open registration, the barrier to entry is extremely low, potentially exposing thousands of installations to unauthorized server access, site defacement, and total system compromise.

Recommendation

Prioritized actions for security operations and IT teams:

• Update the FS-Poster plugin to a version beyond 8.0.1 immediately.
• Audit WordPress user accounts and disable open registration if not required for business operations to mitigate the risk of unauthorized authenticated access.
• Implement web application firewall (WAF) rules to inspect POST requests to the FS-Poster REST API, specifically monitoring for shell metacharacters in parameters related to binary paths.
• Review web server access logs for requests to REST API endpoints originating from users with subscriber-level permissions, focusing on unusual POST parameters.