FS Poster permits Subscriber-level remote command execution
FS Poster through 8.0.1 exposes REST endpoints without adequate authorization and passes the insufficiently sanitized FFmpeg path parameter to exec(). A Subscriber or higher can inject arbitrary operating-system commands and execute them on the WordPress server.
- Component
- FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
- Plugin slug
fs-poster- Affected
- <= 8.0.1
- Safe version
- See mitigation notes
- Published
- Sep 01, 2026
This CVE was published Sep 01, 2026 and is one of 5 known issues for this plugin.
Update, patch or deactivate.
Update to a confirmed release newer than 8.0.1 when available. Until then, disable the affected REST functionality or remove the plugin when warranted, inspect the server for unauthorized commands and files, and rotate exposed credentials.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H