Arbitrary File Upload Vulnerability in FV Player Plugin for WordPress

CVE-2026-83526

What is CVE-2026-83526?

The FV Player plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type verification within the check_mimetype function. All versions up to and including 8.1.7 fail to properly validate uploaded files before writing potentially malicious content to the public uploads directory. This oversight, combined with a lack of capability checks during the creation of new players, allows authenticated users with subscriber-level access and above to upload executable files. Such exploitation could lead to remote code execution if the appropriate conditions, including timing attacks, are achieved.

References