Improper Record Verification in FV Flowplayer Video Player Plugin from WordPress
CVE-2026-108067
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-108067?
The FV Flowplayer Video Player plugin for WordPress prior to version 7.5.56.7212 has a flaw in its record ownership verification process. This vulnerability allows authenticated users with Contributor-level access or higher to modify or delete video and metadata records belonging to other users. Consequently, this can lead to unauthorized access to and disclosure of sensitive metadata. It's crucial for website administrators using this plugin to update to the latest version to protect against potential exploitation.
Affected Version(s)
FV Flowplayer Video Player 0 < 7.5.56.7212
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.