Security Alert Summary
The FS Poster – WordPress Social media Auto Poster & Scheduler plugin (FS-Poster) has a remote code execution vulnerability (CVE-2026-10195) in versions up to and including 8.0.1. The issue stems from insufficient sanitization of an FFmpeg path parameter combined with missing authorization checks on REST API endpoints, allowing authenticated users with subscriber-level access or higher to execute arbitrary commands on the server.
CVE Details
- CVE ID: CVE-2026-10195
- Affected product: FS Poster – WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
- Affected versions: Versions up to and including 8.0.1
- Published: September 1, 2026 at 4:16:47 PM UTC
- Last modified: September 1, 2026 at 4:16:47 PM UTC
- CVSS v3.1: Base Score 8.8, Severity: HIGH
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Privileges Required: Low (authenticated users such as subscribers); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-77 (Improper Neutralization of Special Elements used in a Command)
Technical Details
The plugin fails to sufficiently sanitize the FFmpeg path parameter before passing it to the exec() function. In addition, authorization checks are missing on the relevant REST API endpoints. Together, these issues allow an authenticated user with low privileges (subscriber-level and above) to supply crafted input that is passed to exec(), resulting in execution of arbitrary commands on the underlying server.
Named components in the report include the exec() function and unspecified REST API endpoints; no additional function names or endpoint paths are provided in the source data. The primary technical consequence is remote command execution via unsanitized input combined with insufficient endpoint authorization.
How This Could Impact Your Website
In a typical site environment, multiple users interact with WordPress: a site owner, internal staff (editors or administrators), and external contractors or contributors (subscribers or contributors). Because this vulnerability allows authenticated users with subscriber-level access and above to execute commands on the server, an attacker who gains or already has a low-privilege account could run commands that expose or modify data, or disrupt services.
Practical consequences may include exposure of internal user email addresses and other sensitive data, modification of content or settings, and increased risk of targeted phishing or social-engineering campaigns based on harvested information. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and accounts, especially contributors and other low-privileged roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and server logs for unusual behavior, including unexpected command executions or REST API calls.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
