CVE-2026-83526: FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. Exploitation also requires winning a race condition.
Are sites using the plugin's default access controls protected?
No capability check is performed when creating a new player, so even Subscriber-level accounts can reach the affected functionality.
What is the practical impact if exploitation succeeds?
An attacker may place attacker-controlled content in the public uploads directory before file type validation occurs. If an executable file is uploaded and executed, this can result in remote code execution with high impact to confidentiality, integrity, and availability.
How can I determine whether my site is affected?
Sites running FV Player 8 version 8.1.7 or earlier are affected according to the available information. Review the installed plugin version and investigate unexpected files in the public uploads directory.