Fs Poster Wordpress Social Media Auto Poster Scheduler Facebook Instagram Twitter Pinterest
Monthly
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.