Description
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Static Snapshot | ≤ 0.2.1 | — |
References
- https://wpscan.com/vulnerability/bdf02d4a-3775-410b-b86f-d9dc2408cf2f/ exploit vdb-entry technical-description