CVE-2026-108068
Low
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
SeverityLow
CVSS3.8
Exploit probability—
ProductVideo Player WordPress plugin
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- FV Flowplayer Video Player WordPress plugin7.5.56.7212 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| FV Flowplayer Video Player WordPress plugin | No range specified | 7.5.56.7212 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.