---
id: CVE-2026-108067
title: >-
  FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and
  Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
summary: >-
  The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not
  properly verify record ownership before modifying or deleting stored video and
  meta records, allowing authenticated users with Contributor-level access and
  above…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: FV Flowplayer Video Player
affected:
  - fv_flowplayer_video_player < 7.5.56.7212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:06:26.634941Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:22.478Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108067'
references:
  - url: 'https://wpscan.com/vulnerability/46aca27e-580a-4bb6-895c-dae238629d4f/'
tags:
  - cve.org
epss: 0.00186
epssPercentile: 0.08215
ingestedAt: '2026-11-05T21:36:00.370Z'
---

## Overview

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.

## Affected

- `fv_flowplayer_video_player < 7.5.56.7212`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.