STATIC-SNAPSHOT · CVE-2026-116533 · Package
NO FIX YET · SEE WHAT TO DO
The Static Snapshot WordPress plugin through version 0.2.1 passes a user-supplied value into operating-system commands without removing shell metacharacters. An unauthenticated attacker can run arbitrary commands on the web server.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site with the Static Snapshot plugin installed (0.2.1 or earlier) is exposed, because the flaw is reachable without logging in and lets an attacker run shell commands on the web server. The plugin was closed on WordPress.org in 2019 and has no patched release, so only sites with an old copy still installed are at risk. Sites without the plugin can skip this.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wordpress-plugin
wp plugin list or look under Plugins in WordPress admin for static-snapshot0.2.1 or earlier) is vulnerable, and no later release exists0.2.1 is the last releaseThe Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.