CVE-2026-10195— FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
Quick assessment
Affected
fs-code FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 FS-Poster 插件在 8.0.1 及之前版本中存在远程代码执行（RCE）漏洞。该漏洞源于在将 FFmpeg 路径参数传递给 exec() 函数前，输入清理（sanitization）不足，同时 REST API 端点缺少必要的权限验证。这使得拥有订阅者（subscriber）级别或更高权限的已认证攻击者能够在底层服务器上执行任意命令。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10195
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
Source: CVE Program / CVE List V5
Vulnerability Description
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| fs-code | FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] | 0 ~ 8.0.1 | - |
|
II. Public POCs for CVE-2026-10195
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10195
请登录查看更多情报信息。
Other References for CVE-2026-10195 (2)
IV. Related Vulnerabilities
Same vendor: fs-code
-
CVE-2026-25439
WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulne -
CVE-2025-30960
WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide -
CVE-2025-30962
WordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site S -
CVE-2025-26978
WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerab -
CVE-2025-26926
WordPress Booknetic plugin <= 4.0.9 - Cross Site Request For
Same weakness: CWE-77
-
CVE-2026-79682
Dell PowerStore 命令注入，特权用户可提权 -
CVE-2026-84190
LibreNMS before 26.5.0 Remote Code Execution via AboutContro -
CVE-2026-84059
ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet comman -
CVE-2026-83772
Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsin -
CVE-2026-83524
RedPort Optimizer wXa-223 System Clock datetime.php exec com
V. Comments for CVE-2026-10195
No comments yet