Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

Summary

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

Remediation

1. Inventory every Static Snapshot deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://wpscan.com/vulnerability/bdf02d4a-3775-410b-b86f-d9dc2408cf2f/