Limited Arbitrary File Upload Vulnerability in FV Flowplayer Video Player for WordPress

CVE-2026-86461

What is CVE-2026-86461?

The FV Flowplayer Video Player plugin for WordPress contains a vulnerability that allows authenticated users to exploit insufficient file type validation in the check_mimetype function. This vulnerability makes it possible for users with subscriber-level access and above to upload executable files under specific circumstances where the plugin's 'profile videos on bio' option is enabled. This misconfiguration leads to potential remote code execution, as the plugin fails to enforce appropriate MIME type checks or file extension validations during the upload process. Attackers can bypass certain checks and inject malicious files, compromising the integrity of the WordPress site.

References