A high-severity remote code execution vulnerability in the FS Poster WordPress plugin allows authenticated attackers to compromise the underlying server.

This vulnerability involves improper input sanitization of the FFmpeg path parameter and a lack of authorization checks on REST API endpoints. An authenticated user with subscriber-level access or higher can leverage this flaw to perform command injection via the exec function.

Successful exploitation allows an attacker to execute arbitrary system commands, potentially leading to full server compromise, unauthorized access to sensitive database content, and total loss of system integrity. With a CVSS score of 8.8, this vulnerability represents a significant threat to organizational data security and service availability.

Immediate Action: Update the FS Poster plugin to version 8.0.2 or later immediately to apply the necessary input sanitization and authorization controls.

Proactive Monitoring: Monitor server access logs and WordPress REST API request logs for unusual command patterns or unauthorized attempts to access plugin-specific endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious input patterns in REST API requests, specifically targeting the FFmpeg path configuration parameter.

Public Exploit Available: Unknown

The risk posed by CVE-2026-10195 is substantial because it permits remote code execution, which is a critical security failure. Administrators must prioritize the update to version 8.0.2 as the primary defense. If immediate patching is not possible, organizations should evaluate the necessity of the plugin and consider deactivating it until the update is applied to minimize the attack surface.