FV Flowplayer Video Player: Authenticated arbitrary file upload
Summary
The FV Flowplayer Video Player WordPress plugin up to and including 7.5.54.7212 does not validate file types sufficiently in its check_mimetype function. An authenticated user with Subscriber rights or higher can upload files, which may be executable and could lead to remote code execution. Exploitation requires the 'profile videos on bio' option to be enabled, because it exposes the required nonce to Subscriber accounts.
Affected
- FV Flowplayer Video Player (WordPress plugin) up to and including 7.5.54.7212
- Exploitation requires the 'profile videos on bio' option to be enabled
Fixed in
- Version 7.5.55.7212 (according to WPScan and the WordPress.org changelog; not yet confirmed against the Wordfence advisory)
Workaround
- No workaround documented by the vendor or NVD.
- Interim measure (inference, not vendor guidance): disable the 'profile videos on bio' option.
- Review which accounts can register on the site.
Exploitation
- No evidence of exploitation in the wild was found.
- CISA SSVC data: Exploitation none, automatable no.
- One aggregator reports no public PoC and no CISA KEV listing (not verified against CISA).
- EPSS about 0.0074.
Our recommendation
- Identify all WordPress sites running this plugin and confirm the version.
- Update to version 7.5.55.7212 or later.
- Disable the 'profile videos on bio' option where it is not needed.
- Review sites with open registration for unexpected uploads and executable files.
- Monitor web server logs for suspicious uploads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory CVE-2026-86461 www.wordfence.com
- WordPress.org plugin changeset 3731114 plugins.trac.wordpress.org
- WordPress.org checker.php (vulnerable code) plugins.trac.wordpress.org
- WordPress.org plugin page wordpress.org
- WPScan plugin page wpscan.com
- Vulners CVE-2026-86461 vulners.com
- VulDB entry 420259 vuldb.com
- OpenCVE CVE-2026-86461 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:42.
Original description (NVD)
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.