Arbitrary File Upload in FV Flowplayer Video Player Plugin

The FV Flowplayer Video Player plugin for WordPress, in versions up to and including 7.5.54.7212, is vulnerable to an arbitrary file upload flaw within the 'check_mimetype' function. The vulnerability arises from inadequate validation of user-supplied file uploads. Although the function implements basic extension checking, it lacks robust enforcement, allowing authenticated attackers with subscriber-level permissions to bypass security controls.

To successfully exploit this vulnerability, the target WordPress instance must have the 'profile videos on bio' option enabled. This configuration forces the application to expose a required nonce on the user profile page, which is accessible to subscriber-level users. Without this nonce, unauthorized users cannot execute the upload request. If successful, an attacker can upload executable files to the server, ultimately resulting in remote code execution (RCE). The impact is significant as it allows low-privileged users to achieve full system compromise.

Impact

Successful exploitation allows an authenticated user with subscriber-level access to gain remote code execution on the underlying server. This enables potential unauthorized access to sensitive site data, administrative control over the WordPress instance, and lateral movement within the hosting environment. This affects all WordPress instances using the vulnerable plugin version with the specific profile video feature enabled.

Recommendation

• Immediately update the FV Flowplayer Video Player plugin to version 7.5.54.7213 or higher.
• Audit WordPress installations for active plugins with the 'profile videos on bio' option enabled; disable this feature until the plugin is patched.
• Review access control lists for subscriber-level users to ensure minimal permissions are granted on the target WordPress instance.
• Monitor web server logs for suspicious POST requests targeting plugin-specific upload endpoints, especially those involving non-image file extensions.