{"id":"CVE-2026-118079","kind":"vulnerability","aliases":["CVE-2026-118079"],"related":[],"title":"FV Flowplayer Video Player: shop manager can inject PHP objects","description":"Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.","summary":"FV Flowplayer Video Player, a WordPress plugin, has a PHP Object Injection flaw in versions up to and including 8.3.4. A user with shop manager access can supply crafted serialized data that the plugin unserializes, which can lead to code execution or data tampering depending on available gadget chains.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","php","wordpress"],"not_affected_if":["newer-version","no-shop-manager-users","plugin-not-installed"],"how_to_check":"- Check the installed FV Flowplayer Video Player plugin version in the WordPress admin Plugins screen, or with `wp plugin get fv-wordpress-flowplayer --field=version`\n- Confirm whether untrusted users hold the shop manager role in your WordPress site","fix":"- FV Flowplayer Video Player: versions newer than `8.3.4` (fixed version not stated in the sources)","status":"open","published_at":"2026-10-29T16:18:02+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:46+00:00","updated_at":"2026-10-29T16:29:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player: versions newer than `8.3.4` (fixed version not stated in the sources)","reach":"internet","title":"FV Flowplayer Video Player: shop manager can inject PHP objects","impact":"high","summary":"FV Flowplayer Video Player, a WordPress plugin, has a PHP Object Injection flaw in versions up to and including 8.3.4. A user with shop manager access can supply crafted serialized data that the plugin unserializes, which can lead to code execution or data tampering depending on available gadget chains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated shop manager can run code on the server","analyst_note":"Confirm the fixed plugin version and whether a gadget chain makes this exploitable in default WordPress installs; check the NVD entry and the plugin changelog.","how_to_check":"- Check the installed FV Flowplayer Video Player plugin version in the WordPress admin Plugins screen, or with `wp plugin get fv-wordpress-flowplayer --field=version`\n- Confirm whether untrusted users hold the shop manager role in your WordPress site","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","no-shop-manager-users"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin at version 8.3.4 or older, where users with the shop manager role can reach the vulnerable code path. Sites without the plugin, or with it at a newer version, are not affected; sites that do not give shop manager access to others have a much smaller exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4062,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118079':13A,16A '-2026':12A,15A '8.3.4':42B,82C 'access':48B 'avail':69B 'chain':71B 'code':62B 'craft':51B 'cve':11A,14A 'data':53B,65B 'depend':67B 'execut':63B 'flaw':35B 'flowplay':2A,19B,24B,79C 'fv':1A,18B,23B,78C 'fv-flowplay':17B 'gadget':70B 'includ':41B 'inject':8A,34B,76C 'lead':60B 'manag':6A,47B,73C 'object':10A,33B,75C 'packag':20B 'php':9A,21B,32B,74C 'player':4A,26B,81C 'plugin':29B,56B 'serial':52B 'shop':5A,46B,72C 'suppli':50B 'tamper':66B 'unseri':57B 'user':44B 'version':37B,83C 'video':3A,25B,80C 'wordpress':22B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin at version 8.3.4 or older, where users with the shop manager role can reach the vulnerable code path. Sites without the plugin, or with it at a newer version, are not affected; sites that do not give shop manager access to others have a much smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118079","severity":null,"published_at":"2026-10-29T16:18:02+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}