WordPress Plugin Vulnerabilities
FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard
Description
The plugin does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the plugin's stored video records across the whole site.
Proof of Concept
Affects Plugins
Fixed in 7.5.56.7212 References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
RIA Labs
Submitter
RIA Labs
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)
