WordPress Plugin Vulnerabilities

FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR

Description

The plugin does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.

Proof of Concept

Affects Plugins

Plugin icon
fv-wordpress-flowplayer
Fixed in 7.5.56.7212

References

CVE
CVE-2026-108067

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
RIA Labs
Submitter
RIA Labs
Verified
Yes
WPVDB ID
46aca27e-580a-4bb6-895c-dae238629d4f

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2025-04-01
Title
JS Job Manager <= 2.0.2 - Authenticated Insecure Direct Object Reference
Published
2026-06-29
Title
Simple User Avatar < 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Unauthenticated Membership Modification
Published
2026-09-15
Title
Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
Published
2023-08-07
Title
All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR