{"vulnerability": "cve-2026-83526", "sightings": [{"uuid": "f99b3ac9-8f1e-4136-8cc7-1e9d84114a89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83526", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415059977309974", "content": "CVE-2026-83526 FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition.\nhttps://www.cve.org/CVERecord?id=CVE-2026-83526https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cvehttps://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8#wordpress #foliovision #FVPlayer8#CVE_2026_83526#bot", "creation_timestamp": "2026-10-10T05:53:53.549779Z"}]}