Command Injection Vulnerability in Static Snapshot Plugin by WordPress
CVE-2026-116533

Currently unrated

Key Information:

Vendor

WordPress
Status
Static Snapshot
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-116533?

The Static Snapshot plugin for WordPress prior to version 0.2.1 is susceptible to a command injection vulnerability. This arises from the improper sanitization of shell metacharacters in user-supplied inputs. As a result, unauthorized users can exploit this weakness to execute arbitrary commands on the server, potentially compromising the integrity and confidentiality of the system. It underscores the importance of robust input validation measures in plugin development.

Affected Version(s)

Static Snapshot 0 <= 0.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-116533 - Proof of Concept

References

https://wpscan.com/vulnerability/bdf02d4a-3775-410b-b86f-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.