{"id":"CVE-2026-108067","kind":"vulnerability","aliases":["CVE-2026-108067"],"related":[],"title":"FV Flowplayer WordPress plugin: contributors can edit or delete other users' videos","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.","summary":"The FV Flowplayer Video Player WordPress plugin does not check who owns a video or meta record before changing or deleting it. A logged-in Contributor or higher can modify or delete other users' records and read their associated metadata.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","runtime","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-version-7.5.56.7212-or-later"],"how_to_check":"- Check the installed FV Flowplayer plugin version in the WordPress admin Plugins page or `wp plugin get fv-wordpress-flowplayer --field=version`\n- Confirm whether any users with Contributor-level access or above exist on the site","fix":"- FV Flowplayer Video Player WordPress plugin: upgrade to `7.5.56.7212` or later","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:30+00:00","updated_at":"2026-11-04T06:26:30+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T06:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player WordPress plugin: upgrade to `7.5.56.7212` or later","reach":"network","title":"FV Flowplayer WordPress plugin: contributors can edit or delete other users' videos","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin does not check who owns a video or meta record before changing or deleting it. A logged-in Contributor or higher can modify or delete other users' records and read their associated metadata.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users modify or delete other users' video records and read metadata","analyst_note":"","how_to_check":"- Check the installed FV Flowplayer plugin version in the WordPress admin Plugins page or `wp plugin get fv-wordpress-flowplayer --field=version`\n- Confirm whether any users with Contributor-level access or above exist on the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-7.5.56.7212-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have accounts at Contributor level or above. An attacker needs a valid account on the site, so sites with only administrators and subscribers are lower risk. unknown whether the sources list other affected configurations.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4132,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108067':15A,18A '-2026':14A,17A '7.5.56.7212':76C 'access':99C 'allow':92C 'arbitrari':106C 'associ':66B,116C 'authent':93C 'belong':108C 'chang':45B 'check':36B 'contributor':5A,53B,97C 'contributor-level':96C 'cve':13A,16A 'data':118C 'delet':9A,47B,59B,86C,105C 'disclos':114C 'edit':7A 'flowplay':2A,21B,29B,70C 'fv':1A,20B,28B,69C 'fv-flowplay':19B 'higher':55B 'host':25B 'level':98C 'log':51B 'logged-in':50B 'meta':42B,90C,117C 'metadata':67B 'modifi':57B,84C,103C 'own':38B 'ownership':82C 'player':31B,72C 'plugin':4A,33B,74C 'proper':79C 'read':64B 'record':43B,62B,81C,91C,107C 'respons':121C 'runtim':22B 'self':24B 'self-host':23B 'store':87C 'user':11A,61B,94C,111C 'verifi':80C 'video':12A,30B,40B,71C,88C 'wordpress':3A,26B,32B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have accounts at Contributor level or above. An attacker needs a valid account on the site, so sites with only administrators and subscribers are lower risk. unknown whether the sources list other affected configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","runtime","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108067","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}