SECURITYCRITICALCVE-2026-116533

CVE-2026-116533: Static Snapshot WordPress Plugin Unauthenticated Command Injection

Critical CVSS 9.8 OS command injection in the Static Snapshot WordPress plugin (≤ 0.2.1) lets unauthenticated attackers run commands on the host.

Dylan H.

Security Team

November 6, 2026
2 min read
CVE-2026-116533: Static Snapshot WordPress Plugin Unauthenticated Command Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Static Snapshot WordPress plugin through 0.2.1

CVE-2026-116533: Static Snapshot Command Injection

A critical OS command injection vulnerability affects the Static Snapshot WordPress plugin. Tracked as CVE-2026-116533 (CVSS 9.8, Critical), the plugin does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server. Unauthenticated attackers can execute arbitrary commands on the host.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-116533
CVSS Score9.8 (Critical)
Affected SoftwareStatic Snapshot WordPress plugin, version 0.2.1 and earlier
Attack VectorNetwork, unauthenticated
PublishedNovember 6, 2026

Impact

Commands run with the privileges of the web server user. Attackers can typically read wp-config.php database credentials, drop web shells, deploy miners or ransomware, and pivot to other systems reachable from the host.

Remediation

  1. Locate installs of Static Snapshot across your WordPress estate.
  2. Remove or deactivate the plugin. NVD listed no fixed version at publication.
  3. Hunt for web shells, unexpected PHP files in uploads and plugin directories, and unusual outbound connections or child processes of the web server.
  4. If compromise is suspected, rotate database credentials, WordPress salts and administrator passwords.
  5. Where possible, restrict the PHP process from spawning shell commands.

References