CVE-2026-10195

FS-Poster, a WordPress social-media auto-posting and scheduling plugin, is vulnerable to remote code execution (CWE-77 command injection) in all versions up to and including 8.0.1 because the FFmpeg path parameter is insufficiently sanitized before being passed to the exec() function. The vulnerable parameter is reachable through the plugin's REST API endpoints, which also lack proper authorization checks, so any authenticated user with subscriber-level access or above can send a crafted request that runs arbitrary commands on the underlying server. A successful attacker gains arbitrary command execution with the privileges of the web server, typically enabling full access to site data and files and complete site compromise; the CVSS 3.1 score of 8.8 (high) reflects high impact across confidentiality, integrity, and availability. Any WordPress site running FS-Poster 8.0.1 or earlier is affected, and risk is elevated on sites with open registration or existing subscriber accounts, since only subscriber-level privileges are required to exploit the flaw. There is currently no known public proof-of-concept, no confirmed in-the-wild exploitation, and no CISA KEV listing, and EPSS assigns a 0.6% probability of exploitation within the next 30 days.

What to do: Update FS-Poster to the newest release beyond 8.0.1, verifying the current patched version on the plugin's official listing, as all versions through 8.0.1 are affected. Until patched, restrict access to the plugin's REST API endpoints (e.g., via WAF rules), limit or disable open subscriber registration, review server logs for unexpected exec/FFmpeg invocations, and check for suspicious subscriber accounts or signs of compromise.