CVE-2026-83526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-83526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-83526
Published
2026-10-10T05:30:58Z
Modified
2026-10-30T02:30:51Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
Details

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the "Enable profile videos" setting is enabled.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-434"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83526.json"
}
References

Affected packages

Git / github.com/foliovision/fv-wordpress-flowplayer

Affected ranges

Type
GIT
Repo
https://github.com/foliovision/fv-wordpress-flowplayer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cc108f5affede691af0b985444071de199d94637
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "8.1.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "8.1.8",
            "range":  [
                {
                    "fixed":  "cc108f5affede691af0b985444071de199d94637"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

6.*
6.6.6
7.*
7.1.14.727
7.1.15.727
7.2.0.727
7.2.1.727
7.2.2.727
7.2.3.727
7.2.4.727
7.2.5.727
7.2.6.727
7.2.7.727
7.2.8.727
7.3.0.727
7.3.1.727
7.3.12.727
7.3.13.727
7.3.3.727
7.3.4.727
7.3.6.727
7.3.7.727
7.3.9.727
7.37.727
7.4.0.727
7.4.2.727
7.4.21.727
7.4.24.727
7.4.40.727
7.4.42.727
7.4.46.727
7.4.6.727
7.4.7.727
7.4.9.727
7.5.12.727
8.*
8.0.10
8.0.13
8.0.26
8.0.7
8.0.8
8.1.6
8.1.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83526.json"