CVE-2026-108067 · Runtime
NO FIX YET · SEE WHAT TO DO
The FV Flowplayer Video Player WordPress plugin does not check who owns a video or meta record before changing or deleting it. A logged-in Contributor or higher can modify or delete other users' records and read their associated metadata.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have accounts at Contributor level or above. An attacker needs a valid account on the site, so sites with only administrators and subscribers are lower risk. unknown whether the sources list other affected configurations.
Not affected if no-contributor-accounts, plugin-version-7.5.56.7212-or-later
Who cares fv-flowplayer, self-hosted, wordpress
wp plugin get fv-wordpress-flowplayer --field=version7.5.56.7212 or laterThe FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.