{"id":"CVE-2026-85344","kind":"vulnerability","aliases":["CVE-2026-85344"],"related":[],"title":"FV Flowplayer WordPress plugin lets any logged-in user rewrite site content","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 runs an AJAX action that rewrites content across the site without checking permissions. Any logged-in user, including subscribers, can trigger bulk changes to posts they should not be able to edit.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","self-hosted","wordpress"],"not_affected_if":["no-user-accounts","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/fv-player/` header comments.\n- Confirm whether subscriber-level accounts can register on the site.","fix":"- FV Flowplayer Video Player (WordPress plugin): move to `7.5.57.7212` or later.","status":"open","published_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:12+00:00","updated_at":"2026-11-08T06:47:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:12Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player (WordPress plugin): move to `7.5.57.7212` or later.","reach":"network","title":"FV Flowplayer WordPress plugin lets any logged-in user rewrite site content","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 runs an AJAX action that rewrites content across the site without checking permissions. Any logged-in user, including subscribers, can trigger bulk changes to posts they should not be able to edit.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user bulk-edits site posts they cannot edit","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/fv-player/` header comments.\n- Confirm whether subscriber-level accounts can register on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-user-accounts","plugin-updated"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin older than 7.5.57.7212 where users can log in. Exposure depends on the plugin being active and on accounts existing that can authenticate, including the lowest subscriber role. Sites without the plugin or without any user logins are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4551,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85344':16A,19A '7.5.57.7212':36B,78C 'abl':67B,117C 'across':44B 'action':40B,88C 'ajax':39B,87C 'authent':100C 'author':83C 'bulk':59B,109C 'carri':90C 'chang':60B 'check':48B,84C 'content':13A,43B,96C 'cve':14A,17A 'edit':69B,119C 'flowplay':2A,22B,30B,72C 'fv':1A,21B,29B,71C 'fv-flowplay':20B 'host':26B 'includ':55B,102C 'let':5A 'level':105C 'log':8A,52B 'logged-in':7A,51B 'modif':110C 'packag':23B 'perform':81C 'permiss':49B 'player':32B,74C 'plugin':4A,34B,76C 'post':62B,112C 'rewrit':11A,42B,97C 'run':37B 'self':25B 'self-host':24B 'site':12A,46B,94C 'site-wid':93C 'subscrib':56B,104C 'subscriber-level':103C 'trigger':58B,107C 'user':10A,54B,101C 'video':31B,73C 'wide':95C 'without':47B 'wordpress':3A,27B,33B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin older than 7.5.57.7212 where users can log in. Exposure depends on the plugin being active and on accounts existing that can authenticate, including the lowest subscriber role. Sites without the plugin or without any user logins are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':15A,18A '-85344':16A,19A 'content':13A 'cve':14A,17A 'flowplay':2A 'fv':1A 'let':5A 'log':8A 'logged-in':7A 'plugin':4A 'rewrit':11A 'site':12A 'user':10A 'wordpress':3A","search_b":"'7.5.57.7212':36B 'abl':67B 'across':44B 'action':40B 'ajax':39B 'bulk':59B 'chang':60B 'check':48B 'content':43B 'edit':69B 'flowplay':22B,30B 'fv':21B,29B 'fv-flowplay':20B 'host':26B 'includ':55B 'log':52B 'logged-in':51B 'packag':23B 'permiss':49B 'player':32B 'plugin':34B 'post':62B 'rewrit':42B 'run':37B 'self':25B 'self-host':24B 'site':46B 'subscrib':56B 'trigger':58B 'user':54B 'video':31B 'without':47B 'wordpress':27B,33B","search_c":"'7.5.57.7212':78C 'abl':117C 'action':88C 'ajax':87C 'authent':100C 'author':83C 'bulk':109C 'carri':90C 'check':84C 'content':96C 'edit':119C 'flowplay':72C 'fv':71C 'includ':102C 'level':105C 'modif':110C 'perform':81C 'player':74C 'plugin':76C 'post':112C 'rewrit':97C 'site':94C 'site-wid':93C 'subscrib':104C 'subscriber-level':103C 'trigger':107C 'user':101C 'video':73C 'wide':95C 'wordpress':75C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85344","severity":null,"published_at":"2026-11-08T06:17:05+00:00","modified_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}