FV Flowplayer CVE-2026-86461

Exploitation requires: (1) an authenticated account with subscriber-level access or above (PR:L), and (2) the plugin's 'profile videos on bio' option to be ENABLED - this non-default setting is what causes the required nonce to be emitted on the subscriber-accessible profile page. Without this setting, authenticated users below Editor cannot obtain the nonce and cannot reach the vulnerable upload path. The flaw lies in the check_mimetype function performing incomplete extension validation with no MIME check and bypassing the WordPress upload helper, allowing an executable file to be written. Limiting factors for defenders: valid account required (so sites with closed registration are far less exposed), the specific non-default bio-videos configuration must be active, and the upload is 'limited' arbitrary (extension enforcement is weak but present), so success depends on crafting a filename that evades the partial checks.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) rates this high because it models unauthenticated-adjacent, low-complexity network exploitation by a low-privilege user leading to full CIA impact via remote code execution. However, the description reveals two important tempering factors the base vector does not fully capture: (1) exploitation requires the plugin's non-default 'profile videos on bio' option to be enabled so that the required nonce is emitted on a subscriber-accessible page - without it, users below Editor cannot obtain the nonce, which realistically raises attack complexity; and (2) a valid subscriber-level account is required (PR:L), so this is authenticated, not anonymous. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely serious flaw (file-upload-to-RCE in a widely used plugin, reported by a credible source, Wordfence) that warrants prompt patching, but real-world risk is gated by the need for an open subscriber registration path AND the specific non-default bio-videos configuration. It is a real priority for sites matching those conditions, but not an indiscriminate internet-wide mass-exploitation candidate absent those preconditions.

On a WordPress site running FV Flowplayer with the 'profile videos on bio' option enabled and open user registration, an attacker registers a subscriber account, visits the subscriber-accessible profile page to harvest the emitted nonce, and submits a crafted upload that bypasses the incomplete check_mimetype extension validation to write an executable (e.g. PHP) file. The attacker then requests the uploaded file to achieve remote code execution on the server. No public exploit was identified at time of analysis; exploitation is low-complexity per CVSS once the account and nonce are obtained.