CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
Explanation of Vulnerability in Simple Terms
FS Poster contains a command injection vulnerability in versions up to 8.0.1. An authenticated user with low privileges can inject arbitrary system commands through the plugin's input handling. This allows execution of arbitrary code on the server with the privileges of the web server process. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary system commands on the server with web server privileges.
Potential impact on your site
An attacker with basic WordPress access can execute code on your server, potentially compromising your entire site and data.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
