{"id":"CVE-2026-108068","kind":"vulnerability","aliases":["CVE-2026-108068"],"related":[],"title":"WordPress FV Flowplayer plugin lets contributors read and change all video records","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 has a video-migration function that checks only a nonce, not proper permissions. A logged-in user with Contributor role or higher can read and bulk-modify stored video records across the whole site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-updated"],"how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin under Plugins; affected if it is below `7.5.56.7212`.\n- Review which accounts hold Contributor or higher roles on the site.","fix":"- FV Flowplayer Video Player (WordPress plugin): upgrade to `7.5.56.7212` or later.","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:28+00:00","updated_at":"2026-11-04T06:26:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player (WordPress plugin): upgrade to `7.5.56.7212` or later.","reach":"internet","title":"WordPress FV Flowplayer plugin lets contributors read and change all video records","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 has a video-migration function that checks only a nonce, not proper permissions. A logged-in user with Contributor role or higher can read and bulk-modify stored video records across the whole site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated contributors read and bulk-modify all site video records","analyst_note":"","how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin under Plugins; affected if it is below `7.5.56.7212`.\n- Review which accounts hold Contributor or higher roles on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-updated","no-contributor-accounts"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have users with Contributor-level accounts or higher. Sites without this plugin, or with only administrators and no untrusted contributor accounts, have less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4156,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108068':15A,18A '-2026':14A,17A '7.5.56.7212':35B,81C,126C 'across':69B,131C 'allow':103C 'author':86C 'bulk':64B,116C 'bulk-modifi':63B,115C 'chang':9A 'check':43B,87C 'contributor':6A,56B,107C 'contributor-level':106C 'cve':13A,16A 'disclos':113C 'flowplay':3A,21B,29B,75C,120C 'function':41B,95C 'fv':2A,20B,28B,74C,119C 'fv-flowplay':19B 'higher':59B 'host':25B 'let':5A 'level':108C 'log':52B 'logged-in':51B 'migrat':40B,94C 'modifi':65B,117C 'nonc':46B,101C 'one':89C 'packag':22B 'perform':84C 'permiss':49B,109C 'player':31B,77C,122C 'plugin':4A,33B,79C,124C 'proper':48B,85C 'protect':98C 'read':7A,61B 'record':12A,68B,130C 'role':57B 'self':24B 'self-host':23B 'site':72B,134C 'store':66B,128C 'user':54B,104C 'video':11A,30B,39B,67B,76C,93C,121C,129C 'video-migr':38B,92C 'whole':71B,133C 'wordpress':1A,26B,32B,78C,123C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have users with Contributor-level accounts or higher. Sites without this plugin, or with only administrators and no untrusted contributor accounts, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108068","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}