{"id":"CVE-2026-116533","kind":"vulnerability","aliases":["CVE-2026-116533"],"related":[],"title":"Static Snapshot WordPress plugin: unauthenticated shell command execution on the host","description":"The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.","summary":"The Static Snapshot WordPress plugin through version 0.2.1 passes a user-supplied value into operating-system commands without removing shell metacharacters. An unauthenticated attacker can run arbitrary commands on the web server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"static-snapshot","fixed":[],"affected":"<= 0.2.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or look under Plugins in WordPress admin for static-snapshot. Any installed copy (0.2.1 or earlier) is vulnerable, and no later release exists. The plugin is no longer downloadable from WordPress.org, so check for old copies in wp-content/plugins/static-snapshot.","fix":"No patched version exists. The plugin was permanently closed on WordPress.org on April 29, 2019 (author request) and 0.2.1 is the last release. Remove and delete the plugin.","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:56+00:00","updated_at":"2026-11-06T06:43:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Static Snapshot WordPress plugin: unauthenticated shell command execution on the host","impact":"high","summary":"The Static Snapshot WordPress plugin through version 0.2.1 passes a user-supplied value into operating-system commands without removing shell metacharacters. An unauthenticated attacker can run arbitrary commands on the web server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the web server host","analyst_note":"Find the fixed version and the vulnerable endpoint from the NVD entry or the plugin's WordPress.org page, and confirm whether any later release is patched.","how_to_check":"- Check the installed Static Snapshot plugin version in the WordPress admin under Plugins, or with `wp plugin get static-snapshot --field=version` if WP-CLI is available.\n- Treat any version up to and including `0.2.1` as exposed.\n- unknown for a fixed version: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Static Snapshot WordPress plugin through 0.2.1 are exposed, because the flaw is reachable without logging in. The plugin's user-supplied value is concatenated into server shell commands. Sites that do not have the plugin installed, or run a later version the sources do not name, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4213,"output_tokens":593,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable endpoint from the NVD entry or the plugin's WordPress.org page, and confirm whether any later release is patched.","search":"'-116533':14A,17A '-2026':13A,16A '0.2.1':36B,69C 'allow':93C 'arbitrari':57B,98C 'attack':54B,95C 'command':7A,47B,58B,88C,99C 'concaten':82C 'cve':12A,15A 'execut':8A,97C 'host':11A,24B,102C 'metacharact':51B,74C 'oper':45B,86C 'operating-system':44B,85C 'packag':21B 'pass':37B 'plugin':4A,28B,33B,67C 'remov':49B 'run':56B,89C 'sanitis':72C 'self':23B 'self-host':22B 'server':62B,92C 'shell':6A,50B,73C 'snapshot':2A,20A,31B,65C 'static':1A,19A,30B,64C 'static-snapshot':18A 'suppli':41B,79C 'system':46B,87C 'unauthent':5A,53B,94C 'user':40B,78C 'user-suppli':39B,77C 'valu':42B,80C 'version':35B 'web':61B 'without':48B 'wordpress':3A,25B,27B,32B,66C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Static Snapshot plugin installed (0.2.1 or earlier) is exposed, because the flaw is reachable without logging in and lets an attacker run shell commands on the web server. The plugin was closed on WordPress.org in 2019 and has no patched release, so only sites with an old copy still installed are at risk. Sites without the plugin can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["staticsnapshot"],"ptokens":["snapshot","static"],"labels":["critical","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-116533':14A,17A '-2026':13A,16A 'command':7A 'cve':12A,15A 'execut':8A 'host':11A 'plugin':4A 'shell':6A 'snapshot':2A,20A 'static':1A,19A 'static-snapshot':18A 'unauthent':5A 'wordpress':3A","search_b":"'0.2.1':36B 'arbitrari':57B 'attack':54B 'command':47B,58B 'host':24B 'metacharact':51B 'oper':45B 'operating-system':44B 'packag':21B 'pass':37B 'plugin':28B,33B 'remov':49B 'run':56B 'self':23B 'self-host':22B 'server':62B 'shell':50B 'snapshot':31B 'static':30B 'suppli':41B 'system':46B 'unauthent':53B 'user':40B 'user-suppli':39B 'valu':42B 'version':35B 'web':61B 'without':48B 'wordpress':25B,27B,32B 'wordpress-plugin':26B","search_c":"'0.2.1':69C 'allow':93C 'arbitrari':98C 'attack':95C 'command':88C,99C 'concaten':82C 'execut':97C 'host':102C 'metacharact':74C 'oper':86C 'operating-system':85C 'plugin':67C 'run':89C 'sanitis':72C 'server':92C 'shell':73C 'snapshot':65C 'static':64C 'suppli':79C 'system':87C 'unauthent':94C 'user':78C 'user-suppli':77C 'valu':80C 'wordpress':66C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116533","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116533:1863","url":"https://wordpress.org/plugins/static-snapshot/","severity":null,"published_at":"2026-11-06T06:43:15+00:00","modified_at":"2026-11-06T06:43:15+00:00","first_seen_at":"2026-11-06T06:43:15+00:00","fetched_at":"2026-11-06T06:43:15+00:00","note":"NVD page returned no text; WordPress.org page says the plugin is closed permanently (2019), latest 0.2.1, so no fix. Vulnerable endpoint/parameter not found in any primary source. Fix not marked verified (closure page is not a vendor advisory for the CVE).","cites":["https://wordpress.org/plugins/static-snapshot/"]}],"documents":[{"id":84158,"url":"https://wordpress.org/plugins/static-snapshot/","title":"Static Snapshot – WordPress.org (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of April 29, 2019, not available for download. Closure is permanent. Reason: Author Request. Latest version 0.2.1, last updated 10 years ago.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}