{"id":"CVE-2026-83526","published":"2026-10-10T06:16:43.340","lastModified":"2026-10-13T13:29:12.567","description":"The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cve","tags":[]}],"exploitRefs":[{"url":"https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8","tags":[]}],"hasPoc":true,"ai":{"summary":"The FV Player 8 WordPress plugin allows authenticated users with subscriber-level access or higher to upload arbitrary files, including potentially executable ones, due to weak file type validation and missing capability checks during player creation. This vulnerability can lead to remote code execution when combined with a race condition.","exploitability":"Exploitation requires an authenticated subscriber account or higher, and relies on successfully triggering a race condition to upload executable files that will be executed by the web server.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress site, potentially leading to full compromise of the web application and underlying server resources.","remediation":"Upgrade to version 8.1.8 or later to address the Arbitrary File Upload vulnerability in FV Player 8 plugin.","detection":"Monitor for unusual file uploads in the wp-content/uploads directory, particularly files with executable extensions (.php, .asp, .jsp) that appear without typical user activity patterns, and check for failed capability checks in plugin logs.","tags":["file-upload","rce","wordpress","auth"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:52:51.844Z"}}