FV Flowplayer Video Player: Dangerous file upload
FV Flowplayer Video Player incompletely validates remotely supplied file content in check_mimetype(): extension checks can be bypassed, and files are written without a MIME check or a WordPress upload helper. A Subscriber or higher can reach the disclosed upload path when the profile videos on bio option exposes the required nonce on the user profile page. Without that setting, users below Editor cannot obtain the nonce through this path. Uploaded content may be executable, so code execution depends on the accepted file and hosting execution rules. The export does not identify the upload endpoint or remote-file parameter. Published affected versions: <= 7.5.54.7212.
- Component
- FV Flowplayer Video Player
- Plugin slug
fv-wordpress-flowplayer- Affected
- <= 7.5.54.7212
- Safe version
7.5.55.7212- Published
- Oct 14, 2026
This CVE was published Oct 14, 2026 and is one of 24 known issues for this plugin.
Update, patch or deactivate.
Update the FV Player 7 branch to 7.5.55.7212 or later in that branch. The official author changelog explicitly fixes Subscriber-level arbitrary file upload when profile videos are enabled. If updating is delayed, disable profile videos to restrict the disclosed lower-role nonce path; this does not establish that Editor-level access is protected. Review uploaded files for unexpected executable content. Official release notes: https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H