CVE-2026-85344 · Package
NO FIX YET · SEE WHAT TO DO
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 runs an AJAX action that rewrites content across the site without checking permissions. Any logged-in user, including subscribers, can trigger bulk changes to posts they should not be able to edit.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the FV Flowplayer Video Player WordPress plugin older than 7.5.57.7212 where users can log in. Exposure depends on the plugin being active and on accounts existing that can authenticate, including the lowest subscriber role. Sites without the plugin or without any user logins are not affected.
Not affected if no-user-accounts, plugin-not-installed, plugin-updated
Who cares fv-flowplayer, self-hosted, wordpress
wp-content/plugins/fv-player/ header comments.7.5.57.7212 or later.The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.