The Static Snapshot WordPress plugin version 0.2.1 and earlier fails to sanitise shell metacharacters in the user‑supplied 'name' parameter before embedding it into operating‑system commands executed by the server. This omission allows an unauthenticated attacker to inject arbitrary shell commands, resulting in complete compromise of the host. The flaw exposes the confidentiality, integrity, and availability of the server to remote execution of code.

Any WordPress installation that has the Static Snapshot plugin installed at version 0.2.1 or earlier. The vendor for this plugin is not defined, but the plugin name is publicly known as "Static Snapshot."

The vulnerability enables unauthenticated exploitation; no special privileges or credentials are required. Although a CVSS score is not provided, the nature of the flaw typically maps to a high severity (potentially 9.0+). The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the absence of a patch or mitigations suggests the exploitation risk remains significant. An attacker could use any HTTP request containing the "name" parameter to trigger arbitrary commands on the host, assuming the web server’s shell interpreter is accessible from the context of the plugin.