CVE-2026-10195: FS-Poster WordPress Plugin RCE Vulnerability

CVE-2026-10195 Overview

The FS-Poster plugin for WordPress contains a Remote Code Execution (RCE) vulnerability affecting versions up to and including 8.0.1. The flaw stems from insufficient input sanitization of the FFmpeg path parameter before it is passed to the PHP exec() function. Compounding the issue, the affected REST API endpoints lack proper authorization checks. Authenticated attackers with subscriber-level access or higher can inject arbitrary operating system commands and execute them on the underlying web server. This weakness is categorized under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated attackers holding only subscriber-level WordPress accounts can achieve full command execution on the host, leading to site takeover and lateral movement.

Affected Products

FS-Poster plugin for WordPress versions <= 8.0.1
WordPress sites exposing the FS-Poster REST API endpoints
Any hosting environment where the WordPress process can invoke shell commands

Discovery Timeline

2026-09-01 - CVE-2026-10195 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-10195

Vulnerability Analysis

The FS-Poster plugin exposes REST API endpoints that accept a user-controlled FFmpeg path parameter. This parameter is concatenated into a shell command string and forwarded to PHP's exec() function without adequate neutralization of shell metacharacters. Because the REST route is missing an authorization check appropriate to the sensitivity of the action, any authenticated WordPress user, including subscribers, can reach the vulnerable code path.

WordPress installations commonly allow open user registration for commenting, membership, or WooCommerce customer flows. That default posture turns this authenticated bug into a broadly reachable pre-privilege RCE. Successful exploitation yields command execution as the web server user, exposing WordPress database credentials in wp-config.php, session tokens, and any files readable by the PHP process.

Root Cause

The root cause is a combination of two defects. First, the FFmpeg path parameter is passed to exec() without escaping via escapeshellarg() or a strict allow-list validator. Second, the REST endpoint uses a permission_callback that returns true for any logged-in user rather than restricting access to administrators. Together these defects produce a classic command injection primitive [CWE-77].

Attack Vector

An attacker registers or logs in to a WordPress account with subscriber-level access. The attacker then issues a crafted request to the vulnerable FS-Poster REST endpoint, supplying an FFmpeg path value that contains shell metacharacters such as ;, &&, or backticks followed by an arbitrary command. The server passes the concatenated string to exec(), and the injected command runs in the context of the PHP worker.

Detailed technical analysis is available in the Wordfence Vulnerability Report. No public proof-of-concept exploit code has been released at time of writing.

Detection Methods for CVE-2026-10195

Indicators of Compromise

Unexpected child processes such as sh, bash, curl, wget, or python spawned by the PHP-FPM or Apache worker on WordPress hosts running FS-Poster.
New or modified PHP files under wp-content/uploads/ or plugin directories, particularly webshells with obfuscated eval or assert constructs.
Outbound network connections from the web server to unfamiliar IP addresses shortly after requests to FS-Poster REST routes.
Access log entries showing authenticated subscribers hitting /wp-json/ routes belonging to the FS-Poster plugin.

Detection Strategies

Alert on WordPress REST API requests to FS-Poster endpoints where the request body contains shell metacharacters (;, |, &, backticks, $().
Correlate low-privilege WordPress authentication events with subsequent process creation events on the underlying host.
Baseline expected child processes of the PHP interpreter and flag deviations, especially interactive shells or network utilities.

Monitoring Recommendations

Ingest WordPress access logs, PHP error logs, and host process telemetry into a centralized analytics platform for correlated hunting.
Monitor for creation of new administrator accounts, changes to wp-config.php, and modifications to the plugin directory.
Track outbound egress from web server hosts and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-10195

Immediate Actions Required

Update the FS-Poster plugin to a version later than 8.0.1 as soon as a fixed release is available from the vendor. Consult the FS Poster Update Changelogs for release notes.
Audit WordPress user accounts and remove or downgrade unnecessary subscriber and higher-privilege accounts.
Disable open user registration on sites that do not require it by unchecking Anyone can register in Settings > General.
Review web server and PHP process logs for signs of prior exploitation before applying the patch.

Patch Information

Refer to the vendor changelog at FS Poster Update Changelogs for the specific fixed version. Apply the update through the WordPress admin plugin manager or via wp-cli using wp plugin update fs-poster. Validate the installed version after the update.

Workarounds

Deactivate and remove the FS-Poster plugin until a patched version is installed.
Block requests to FS-Poster REST API routes at the web application firewall or reverse proxy layer for non-administrator sessions.
Restrict WordPress registration to trusted flows and require email verification and CAPTCHA to slow automated account creation.
Run the PHP process under a least-privilege user and disable unused shell-invoking functions such as exec, system, shell_exec, and passthru via disable_functions in php.ini where operationally feasible.

bash

# Configuration example: disable shell-invoking PHP functions in php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen