CyberRota Analysis
AI-GeneratedThe FS-Poster plugin for WordPress versions up to and including 8.0.1 is vulnerable to Remote Code Execution due to inadequate input sanitization of the FFmpeg path parameter and lack of authorization checks on REST API endpoints. This vulnerability allows authenticated attackers with subscriber-level access or higher to execute arbitrary commands on the server, posing a significant risk to the integrity of the affected systems. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.