{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afv_flowplayer_video_player_projectfv_flowplayer_video_playerwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fv_flowplayer_video_player_project:fv_flowplayer_video_player:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-86461"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FV Flowplayer Video Player (\u003c= 7.5.54.7212)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe FV Flowplayer Video Player plugin for WordPress, in versions up to and including 7.5.54.7212, is vulnerable to an arbitrary file upload flaw within the 'check_mimetype' function. The vulnerability arises from inadequate validation of user-supplied file uploads. Although the function implements basic extension checking, it lacks robust enforcement, allowing authenticated attackers with subscriber-level permissions to bypass security controls.\u003c/p\u003e\n\u003cp\u003eTo successfully exploit this vulnerability, the target WordPress instance must have the 'profile videos on bio' option enabled. This configuration forces the application to expose a required nonce on the user profile page, which is accessible to subscriber-level users. Without this nonce, unauthorized users cannot execute the upload request. If successful, an attacker can upload executable files to the server, ultimately resulting in remote code execution (RCE). The impact is significant as it allows low-privileged users to achieve full system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with subscriber-level access to gain remote code execution on the underlying server. This enables potential unauthorized access to sensitive site data, administrative control over the WordPress instance, and lateral movement within the hosting environment. This affects all WordPress instances using the vulnerable plugin version with the specific profile video feature enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the FV Flowplayer Video Player plugin to version 7.5.54.7213 or higher.\u003c/li\u003e\n\u003cli\u003eAudit WordPress installations for active plugins with the 'profile videos on bio' option enabled; disable this feature until the plugin is patched.\u003c/li\u003e\n\u003cli\u003eReview access control lists for subscriber-level users to ensure minimal permissions are granted on the target WordPress instance.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests targeting plugin-specific upload endpoints, especially those involving non-image file extensions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T18:45:31Z","date_published":"2026-10-14T18:45:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fv-flowplayer-rce/","summary":"Authenticated users can achieve remote code execution in FV Flowplayer Video Player for WordPress \u003c= 7.5.54.7212 by bypassing incomplete file type validation in the check_mimetype function.","title":"Arbitrary File Upload in FV Flowplayer Video Player Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-fv-flowplayer-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fv_flowplayer_video_player_project:fv_flowplayer_video_player:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}