CVE-2026-108067: FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Contributor role or any higher-privileged role can exploit it. The issue affects the FV Flowplayer Video Player plugin before version 7.5.56.7212.
What access or conditions does an attacker need?
The attacker needs a valid authenticated account with Contributor-level access or above. They can target stored video and meta records belonging to other users because ownership is not properly verified.
What could an attacker do through this vulnerability?
An eligible authenticated user can modify or delete arbitrary video and meta records owned by other users. Associated meta data may also be disclosed in the response.
How can I tell whether my site is affected?
Check the installed FV Flowplayer Video Player version. Versions earlier than 7.5.56.7212 are affected.