Vulnerability record/PUBLISHED/Published Nov 8, 2026 06:00:27 UTC
CVE-2026-85344
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 8, 2026 06:00:27 UTC
PublishedNov 8, 2026 06:00:27 UTC
ReservedSep 3, 2026 17:14:16 UTC
Credits
- Karthik Ramakrishnan
- WPScan