Authorization Bypass in FV Flowplayer Video Player Plugin by WordPress
CVE-2026-108068
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-108068?
The FV Flowplayer Video Player plugin for WordPress lacks sufficient authorization checks in its video-migration functions, relying solely on nonces for protection. This oversight enables users with Contributor-level privileges and above to access and modify the plugin's stored video records site-wide, potentially leading to unauthorized data exposure and manipulation. It is crucial for users to update to the latest version to mitigate this vulnerability.
Affected Version(s)
FV Flowplayer Video Player 7.4.44.727 < 7.5.56.7212
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.