CVE-2026-86461

Deferred Deferred - Pending Action

Arbitrary File Upload in FV Flowplayer Video Player

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86461

EUVD

EUVD-2026-101496

Affected Vendors & Products

Vendor	Product	Version / Range
foliovision	FV	Flowplayer Video Player 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is in the FV Flowplayer Video Player plugin for WordPress. It allows authenticated attackers with subscriber-level access or higher to upload arbitrary files that may be executable due to incomplete file type validation. The attack requires the plugin's 'profile videos on bio' option to be enabled to obtain a necessary nonce.

Detection Guidance

Check if the FV Flowplayer Video Player plugin is installed and its version is up to 7.5.54.7212. Look for unauthorized file uploads in WordPress directories, especially those with executable extensions. Review user roles with subscriber access or higher for unusual activity.

Impact Analysis

An attacker could upload malicious files to your WordPress site, potentially leading to remote code execution. This could allow them to take control of your site, steal data, or perform other harmful actions.

Compliance Impact

This vulnerability allows authenticated attackers to upload arbitrary files, including potentially malicious executable files, due to insufficient file validation. This could lead to unauthorized code execution on the server, which may result in data breaches or unauthorized access to sensitive information. Such breaches could violate compliance requirements under GDPR and HIPAA, depending on the data exposed or compromised.

Mitigation Strategies

Update the FV Flowplayer Video Player plugin to the latest version beyond 7.5.54.7212. Disable the 'profile videos on bio' option if enabled. Restrict subscriber-level access to only necessary users. Monitor for suspicious file uploads in WordPress directories.

Hi! I’m here to help you understand CVE-2026-86461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70