Live › vulnerability › CVE-2026-118079
FV Flowplayer Video Player, a WordPress plugin, has a PHP Object Injection flaw in versions up to and including 8.3.4. A user with shop manager access can supply crafted serialized data that the plugin unserializes, which can lead to code execution or data tampering depending on available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the FV Flowplayer Video Player WordPress plugin at version 8.3.4 or older, where users with the shop manager role can reach the vulnerable code path. Sites without the plugin, or with it at a newer version, are not affected; sites that do not give shop manager access to others have a much smaller exposure.
No product ranges from the sources yet.
wp plugin get fv-wordpress-flowplayer --field=version8.3.4 (fixed version not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118079")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.