Remote Code Execution Vulnerability in FS-Poster Plugin for WordPress
CVE-2026-10195

8.8HIGH

Key Information:

Vendor

WordPress
Status
Fs Poster - WordPress Social Media Auto Poster & Scheduler [facebook, Instagram, Twitter, Pinterest]
Vendor
CVE Published:
1 September 2026

What is CVE-2026-10195?

The FS-Poster plugin for WordPress contains a vulnerability allowing Remote Code Execution due to inadequate input sanitization of the FFmpeg path parameter and the absence of proper authorization checks on the REST API endpoints. This vulnerability permits authenticated attackers with subscriber-level access and higher to execute arbitrary commands on the server, thereby potentially compromising the integrity and confidentiality of the system.

Affected Version(s)

FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] 0 <= 8.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.fs-poster.com/documentation/updates-changelogs

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sullo
.