CVE-2026-108068
Received Received - Intake

Authorization Bypass in FV Flowplayer Video Player

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WPScan

Description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-108068
EUVD
EUVD-2026-116717

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown FV Flowplayer Video Player 7.4.44.727

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212. It allows users with Contributor-level permissions or higher to disclose and bulk-modify video records stored by the plugin. The issue occurs because a video-migration function lacks proper authorization checks and is only protected by a nonce.

Detection Guidance

Check the installed version of the FV Flowplayer Video Player plugin. If it is between 7.4.44.727 and 7.5.55.7212, the system is vulnerable. Review user permissions for Contributor-level roles and above to see if unauthorized modifications to video records occurred.

Impact Analysis

If you use the vulnerable plugin version, attackers with Contributor-level access could view or alter video records across your entire WordPress site. This could lead to unauthorized changes, data leaks, or disruption of video content.

Mitigation Strategies

Update the FV Flowplayer Video Player plugin to version 7.5.56.7212 or later immediately. Review and audit video records for unauthorized changes made by users with Contributor-level permissions or higher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108068. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...