Fs Code
Monthly
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Account takeover in Booknetic WordPress appointment booking plugin versions 4.8.5 and earlier allows remote unauthenticated attackers to bypass authentication controls and gain access to arbitrary user accounts. The Patchstack advisory characterizes this as a broken authentication weakness (CWE-288) with high impact across confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and exploitation requires high attack complexity per the CVSS vector.
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Account takeover in Booknetic WordPress appointment booking plugin versions 4.8.5 and earlier allows remote unauthenticated attackers to bypass authentication controls and gain access to arbitrary user accounts. The Patchstack advisory characterizes this as a broken authentication weakness (CWE-288) with high impact across confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and exploitation requires high attack complexity per the CVSS vector.
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.