CVE-2026-83526Published
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-83526 · Microsoft / collected KEV context
cve-program · CVE-2026-83526
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cve
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211
- https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8
Related operational evidence
Explicit CVE identifiers- FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter · Advisory content revised · 28 Oct 2026