FV Flowplayer CVE-2026-118079

Requires an authenticated WordPress user with the Shop manager role (a WooCommerce store-management role), so this is not anonymously exploitable despite AV:N. The attacker must reach a plugin input that is passed to PHP deserialization (unserialize) and supply a crafted serialized object; the specific feature or endpoint is not described in the available sources. Realized impact is further gated on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin - without one, object injection may not reach code execution. The Shop-manager privilege requirement and the version ceiling (<= 8.3.4) are the primary limiting factors.

Signals are mixed and point to a real but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, 7.2 High) describes a network-reachable, low-complexity flaw with no user interaction but requiring high privileges (PR:H), which aligns with the 'Shop manager' role named in the title - a WooCommerce-level account, not an anonymous visitor. No EPSS score was supplied and the vuln.today decision label is 'this_week' (not act_now/emergency), so this is a prioritized-but-not-drop-everything issue. It is not in CISA KEV and no verified exploit is listed, so there is no evidence of active exploitation. The principal caveat: CWE-502 PHP Object Injection only yields high impact (C:H/I:H/A:H, and potentially code execution) when a usable POP gadget chain exists in the plugin, WordPress core, or another installed plugin - the supplied evidence does not confirm such a chain, so the full I/A/C impact is the theoretical ceiling rather than a confirmed outcome. The requirement for an authenticated Shop manager account meaningfully narrows the attacker population to users who already hold a privileged store role.

An attacker who holds (or has compromised) a WordPress Shop manager account on a site running FV Flowplayer Video Player <= 8.3.4 submits a crafted serialized string to an input the plugin deserializes, instantiating an attacker-controlled PHP object. If a suitable gadget (POP) chain is present in the stack, this can escalate to file operations or code execution in the site's context. No public exploit code is identified at time of analysis, and the precise injection point is not described in the available sources.