The FS Poster plugin for WordPress is vulnerable to remote code execution because the FFmpeg path parameter is passed directly to the exec() function without proper sanitization, leading to a command injection flaw (CWE-77). An attacker with subscriber-level or higher privileges can supply malicious input to the REST API endpoint that controls this path, allowing arbitrary commands to run on the underlying server. The potential impact could include compromise of confidentiality, integrity and availability of the affected WordPress installation, although the CVE description does not explicitly state this loss.

This vulnerability affects the FS Poster plugin provided by fs-code, used for automating posts across Facebook, Instagram, Twitter and Pinterest. Versions up to and including 8.0.1 are impacted; newer releases contain a patch.

The CVSS score is 8.8, indicating a high severity issue. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers need authenticated access with a subscriber role or higher, but once authenticated, the REST API permits exploitation. The attack vector is remote and does not require local host access. An exploit can be performed by sending a crafted FFmpeg path value to the exposed REST endpoint, causing the server to execute arbitrary code.