Executive brief
FS-Poster is a popular WordPress plugin that automates social media publishing and content scheduling. The plugin fails to properly validate the FFmpeg path parameter and lacks authorization checks on certain API endpoints, allowing authenticated users with subscriber-level access to execute arbitrary commands on the server hosting WordPress. An attacker can exploit this to take over the entire website or hosting environment.
Technical details
The vulnerability is a command injection flaw in the FFmpeg path handling within FS-Poster versions up to 8.0.1. The plugin passes user-supplied FFmpeg path input directly to PHP's exec() function without proper sanitization, combined with missing authorization checks on REST API endpoints. An authenticated attacker with subscriber-level privileges or higher can inject shell commands into the FFmpeg path parameter via the REST API, leading to arbitrary command execution with the privileges of the web server process. The vulnerability was addressed in version 8.0.2 with improved input sanitization for FFmpeg path handling, and further security improvements were made in subsequent releases including safer FFmpeg execution through a process wrapper in version 8.1.1.
Affected products
- FS Code FS-Poster up to and including 8.0.1
Timeline
- 2026-09-01: disclosed
- 2026-06-10: patched: Version 8.0.2 released with improved input sanitization for FFmpeg path handling