---
id: "CVE-2026-116533"
page: "https://infrastack.ai/live/CVE-2026-116533"
kind: "vulnerability"
aliases: ["CVE-2026-116533"]
title: "Static Snapshot WordPress plugin: unauthenticated shell command execution on the host"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "static-snapshot", "fixed": [], "affected": "<= 0.2.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T06:16:40+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:43:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116533", "first_seen_at": "2026-11-06T06:40:11+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/static-snapshot/", "first_seen_at": "2026-11-06T06:43:15+00:00", "cites": ["https://wordpress.org/plugins/static-snapshot/"]}]
exploit_sources: []
---

# Static Snapshot WordPress plugin: unauthenticated shell command execution on the host

Link for people: https://infrastack.ai/live/CVE-2026-116533 (this .md is for agents)

The Static Snapshot WordPress plugin through version 0.2.1 passes a user-supplied value into operating-system commands without removing shell metacharacters. An unauthenticated attacker can run arbitrary commands on the web server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:static-snapshot affected <= 0.2.1 fixed no fixed version listed

## How to check

Run 'wp plugin list' or look under Plugins in WordPress admin for static-snapshot. Any installed copy (0.2.1 or earlier) is vulnerable, and no later release exists. The plugin is no longer downloadable from WordPress.org, so check for old copies in wp-content/plugins/static-snapshot.

## Fix

No patched version exists. The plugin was permanently closed on WordPress.org on April 29, 2019 (author request) and 0.2.1 is the last release. Remove and delete the plugin.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116533
- 2026-11-06T06:43:15+00:00 analyst https://wordpress.org/plugins/static-snapshot/ — NVD page returned no text; WordPress.org page says the plugin is closed permanently (2019), latest 0.2.1, so no fix. Vulnerable endpoint/parameter not found in any primary source. Fix not marked verified (closure page is not a vendor advisory for the CVE).

## Documents

- [advisory] Static Snapshot – WordPress.org (closed) https://wordpress.org/plugins/static-snapshot/

## From the sources

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_