CVE-2026-10195: FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Any authenticated WordPress account with Subscriber-level access or higher can exploit it. No administrator privileges or user interaction are required.
What must be exposed for an attacker to execute commands?
The attacker needs a valid WordPress account and access to the affected plugin's REST API endpoints. The vulnerable FFmpeg path parameter is passed to exec() without sufficient sanitization, and the endpoints lack authorization checks.
Are installations running version 8.0.1 affected?
Yes. FS-Poster versions up to and including 8.0.1 are affected.