CVE-2026-10195: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in fs-code FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]

CVE-2026-10195 is a command injection vulnerability (CWE-77) in the FS-Poster WordPress plugin (up to version 8.0.1). It results from insufficient input sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. This allows authenticated attackers with subscriber-level privileges or higher to execute arbitrary commands on the underlying server, potentially leading to full system compromise. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation allows an authenticated user with subscriber-level access or higher to execute arbitrary commands on the server hosting the FS-Poster plugin. This can lead to full compromise of the server, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints of the FS-Poster plugin to trusted users only and consider disabling the plugin if possible. Monitor for updates from the vendor or security advisories for patches addressing this vulnerability.