3.8
Low
CVE-2026-108067 FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FV Flowplayer Video Player 7.5 | earliest → < 7.5.56.7212 | 7.5.56.7212 |
Other CVEs of FV Flowplayer Video Player
The 6 CVEs of FV Flowplayer Video Player →
CVE-2026-85351
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
5.0
Medium
CVE-2026-85347
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
6.8
Medium
CVE-2026-85346
FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
4.3
Medium
CVE-2026-108068
FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard
3.8
Low