Description

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T16:16:47.467Z",
  "pubdate": "2026-09-01T16:16:47.467Z",
  "executiveSummary": "The FS-Poster plugin for WordPress, in versions up to and including 8.0.1, contains a critical Remote Code Execution (RCE) vulnerability. This security flaw stems from inadequate input sanitization of the FFmpeg path configuration parameter, which is subsequently processed by the server-side exec() function. Additionally, the vulnerability is exacerbated by missing authorization validation on specific REST API endpoints, allowing unauthorized or low-privileged users to interact with sensitive settings.\nThe vulnerability allows an authenticated attacker possessing at least subscriber-level privileges to inject and execute arbitrary system commands on the underlying web server. By manipulating the FFmpeg path parameter, an attacker can bypass intended functional constraints to gain OS-level command execution. This risk is severe, as successful exploitation facilitates complete server compromise, including unauthorized access to site data, potential lateral movement within the hosting environment, and full system control. The combination of insufficient input validation and broken access control in the REST API makes this a high-impact threat requiring immediate remediation for all deployments running affected versions.",
  "technicalDetails": "The vulnerability resides within the FS-Poster WordPress plugin's backend configuration handling logic. Specifically, the application exposes REST API endpoints intended for updating system configuration parameters, including the path to the FFmpeg binary. The root cause of this RCE is twofold: improper authorization checks on the REST API endpoint and the insecure handling of user-supplied input by the system command execution interface.\nUnder normal operations, the plugin utilizes the exec() function to invoke FFmpeg for media processing tasks. The application fails to sanitize or validate the 'ffmpeg_path' parameter, allowing an attacker to inject shell metacharacters such as ';', '&', or '|' to terminate the intended command and append malicious payloads. Because the REST API endpoint fails to enforce sufficient privilege checks, a user with subscriber-level access can perform a crafted POST request to update the FFmpeg path configuration.\nThe attack flow proceeds as follows: 1. The attacker authenticates as a subscriber to the WordPress instance. 2. The attacker identifies the REST API endpoint responsible for updating FS-Poster settings. 3. The attacker submits a malicious request where the 'ffmpeg_path' parameter is replaced with a payload designed to trigger system commands (e.g., '123; whoami;'). 4. The application saves this malicious path into its configuration. 5. Subsequent plugin activity triggers the execution of the stored path string via the PHP exec() function. 6. The OS executes the injected command with the privileges of the web server process (e.g., www-data).\nThis vulnerability highlights a critical failure in both input filtering and access control implementation. By allowing an attacker to control the arguments passed to shell execution functions, the plugin transforms an intended administrative feature into a remote command injection vector. The lack of strict verification ensures that the malicious input is persisted in the database and subsequently invoked, bypassing security barriers that would otherwise prevent arbitrary code execution. The impact of successful exploitation is total system compromise, where the attacker may execute arbitrary binary code, exfiltrate the WordPress database, or use the server as a node for further network attacks."
}