{"id":"CVE-2026-108067","title":"FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above…","severity":"low","cvss":3.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-639"],"product":"FV Flowplayer Video Player","affected":["fv_flowplayer_video_player < 7.5.56.7212"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T14:06:26.634941Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:22.478Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108067","references":[{"url":"https://wpscan.com/vulnerability/46aca27e-580a-4bb6-895c-dae238629d4f/"}],"tags":["cve.org"],"epss":0.00186,"epssPercentile":0.08215,"ingestedAt":"2026-11-05T21:36:00.370Z","slug":"CVE-2026-108067","body":"## Overview\n\nThe FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.\n\n## Affected\n\n- `fv_flowplayer_video_player < 7.5.56.7212`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}