Vulnerability record/PUBLISHED/Published Nov 4, 2026 06:00:24 UTC
CVE-2026-108067
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Base score3.8/ 10
SeverityLowCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 4, 2026 14:18:22 UTC
PublishedNov 4, 2026 06:00:24 UTC
ReservedOct 9, 2026 11:32:45 UTC
Credits
- RIA Labs
- WPScan