CVE-2026-85344
FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
What each source reports
CVE List No score
FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
- Record
CVE-2026-85344- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-m836-p73r-8pm6 No score
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any...
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
- Record
GHSA-m836-p73r-8pm6- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85344 is a vulnerability with no CVSS score yet in Unknown Fv Flowplayer Video Player, published November 8, 2026. No source lists public exploit code. No source names a fixed version.