{"id":"CVE-2026-83526","revision":"e23fc87c60b7443db3a66e4fa469dc56","records":[{"revision":"e23fc87c60b7443db3a66e4fa469dc56","observedAt":"2026-10-28T17:46:48.824+00:00","statement":{"source":"cve-program","id":"CVE-2026-83526","aliases":[],"title":"FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter","description":"The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the \"Enable profile videos\" setting is enabled.","state":0,"publishedAt":"2026-10-10T05:30:58.064+00:00","modifiedAt":"2026-10-28T16:56:44.443+00:00","affected":[{"ecosystem":"Vendor product","name":"FV Player 8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"foliovision\",\n                    \"product\": \"FV Player 8\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"8.1.7\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cve","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173","https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855","https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36","https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211","https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-83526","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-83526","identifiers":["CVE-2026-83526"]},"retained":false,"historicalAffected":[]}],"coverage":[]}