FV Player 8 EUVD-2026-96092

Requires an authenticated WordPress account at subscriber level or above (PR:L), and the target must be running FV Player 8 ≤ 8.1.7; sites allowing open user self-registration effectively lower this to any remote attacker. The specific trigger is the new-player-creation flow, which lacks a capability check and invokes check_mimetype(), causing attacker-supplied remote file content to be written to the public uploads directory before any MIME or extension validation. The key limiting factor is that successful exploitation depends on winning a race condition between the pre-validation write and the subsequent validation step, which reduces reliability and may require many attempts; the planted file must also land in a web-executable location (e.g. PHP execution permitted in the uploads directory) for RCE to follow.

The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) frames this as a network-reachable, low-complexity, low-privilege path to full RCE. However, the signals conflict on complexity: the description explicitly states exploitation 'requires successfully exploiting a race condition,' which realistically raises attack complexity above the AC:L in the published vector - a defender should treat this as AC:H in practice. Privilege requirement is genuine but minimal: PR:L corresponds to subscriber-level accounts, which are self-registerable on many WordPress sites that allow open registration, lowering the practical barrier. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a real and serious priority for any site running FV Player 8 with open user registration, because the payoff is RCE, but the required race-condition win plus the need for an authenticated account make reliable mass exploitation harder than the 8.8 score alone suggests - closer to a motivated/targeted threat than a spray-and-pray one until an exploit is published.

An attacker registers (or obtains) a subscriber-level WordPress account on a site running FV Player 8 ≤ 8.1.7, then invokes the player-creation flow that calls check_mimetype(), which fetches attacker-controlled remote content and writes it into the public uploads directory before any MIME/extension validation occurs. By repeatedly triggering the upload and racing the subsequent validation/cleanup, the attacker wins the race so an executable (e.g. PHP) file survives in a web-accessible path and is then requested directly to execute code. No public proof-of-concept was provided, so exploitation currently requires developing the race-condition exploit independently.