CVE-2026-86461

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.54.7213

Description Authenticated users with subscriber-level access and above can perform a limited arbitrary file upload due to incomplete file type validation in the check mimetype() function. This flaw allows attackers to bypass extension checks and write remote file content without a MIME check or the WordPress upload helper, potentially leading to remote code execution if executable files are uploaded. This issue is exploitable only when the 'profile videos on bio' option is enabled, as this setting exposes the required nonce on the profile page to lower-level authenticated users.

Recommendations Update to a version newer than 7.5.54.7212. Disable the 'profile videos on bio' option to prevent the exposure of the nonce to subscriber-level users.