FV Player 8 WordPress plugin: Arbitrary file upload in check_mimetype
Summary
FV Player 8 for WordPress up to and including version 8.1.7 writes attacker-supplied remote file content to the public uploads directory before MIME type or extension checks run. Authenticated users with subscriber-level access or higher can upload potentially executable files, which may lead to remote code execution. Exploitation requires winning a race condition and only works if the [fvplayer_editor] shortcode is present or the "Enable profile videos" setting is enabled.
Affected
- FV Player 8 (WordPress plugin) versions up to and including 8.1.7
- Unaffected by default; conditions apply (see summary)
Fixed in
- FV Player 8.1.8 (vendor release dated 05 Oct 2026)
Workaround
- Disable the [fvplayer_editor] shortcode and the "Enable profile videos" setting if you cannot update immediately (recommendation, not a vendor statement)
- Restrict subscriber self-registration to reduce the number of authenticated accounts
- Block execution of PHP and other executable files in the uploads directory at the web server level; test before relying on it
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- EPSS approximately 0.006
- No public proof of concept or reports of in-the-wild exploitation found in a non-exhaustive search
- Not in CISA KEV according to a third-party issue; not verified directly
Our recommendation
- Update FV Player 8 to version 8.1.8 or later on all WordPress sites
- Check whether the [fvplayer_editor] shortcode is used or "Enable profile videos" is enabled and disable them until patched
- Review user accounts with subscriber-level access or higher and remove unneeded accounts
- Check the uploads directory for unexpected executable files and monitor for new ones
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- FV Player 8.1.8 release (vendor) github.com
- Wordfence advisory www.wordfence.com
- VulDB CVE-2026-83526 vuldb.com
- OSV CVE-2026-83526 osv.dev
- OpenCVE CVE-2026-83526 app.opencve.io
- Rapid7 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:46.
Original description (NVD)
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the "Enable profile videos" setting is enabled.
NVD references (11)
- https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.