CVE-2026-86461 is a high severity unrestricted file upload in the FV Flowplayer Video Player plugin for WordPress, all versions up to and including 7.5.54.7212. An authenticated user with subscriber access or above can upload files that may be executable, which makes remote code execution possible. Update to the latest plugin release.
What's affected
Affected: FV Flowplayer Video Player (fv-wordpress-flowplayer), all versions up to and including 7.5.54.7212, per the record. The flaw is in the check_mimetype function.
An important condition from the record: exploitation needs the plugin's "profile videos on bio" option to be enabled. That option causes a required nonce to be emitted on the profile page that subscribers can see. Without it, authenticated users below Editor cannot obtain the nonce.
I could not read the Wordfence page or the WordPress plugin repository pages (the plugin repository returned a browser check page), so I cannot name the first fixed version from a source I read. The record links changeset 3731114 as the fix reference. Check the plugin's changelog for the release that contains it. The record scores this 8.8 (High). I found no second score. It is not in CISA KEV.
How to check if you're exposed
List the installed version and status of the plugin with WP-CLI:
wp plugin list --name=fv-wordpress-flowplayer --fields=name,status,version
Or open Plugins in the WordPress admin and read the version under the plugin name. Anything at or below 7.5.54.7212 is affected.
Then check the condition that makes the bug reachable. In the plugin settings, look for the option that allows profile videos on the bio, and note whether it is on. Also check whether your site allows open registration, because the attacker only needs subscriber level access.
Finally, review the uploads directory for files you do not recognize, especially script files where only media should be.
What to do now
- Update FV Flowplayer to the newest release from the WordPress plugin directory and confirm it is above 7.5.54.7212.
- Turn off the profile videos on bio option if you do not use it.
- If you allow public registration, review it and remove unused subscriber accounts.
- Review the uploads folder for unexpected script files and remove anything suspicious after preserving it for investigation.
- Disable script execution in the uploads directory at the web server level as a standing control.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type (CWE-434). The check_mimetype function did some extension checking, but the record says it could be bypassed, and the code then wrote the supplied remote file content without proper extension enforcement, MIME checking or WordPress upload helpers.
Upload bugs matter because the end of the chain is a file on the web server that the server may run. The bar here is low: subscriber is the default role for people who register on many sites, so the barrier is whether registration is open and whether the profile videos option is on.
Two controls make this class far less dangerous: refuse to execute scripts from the uploads directory, and keep the plugin set small. Both are worth doing whether or not this plugin is installed.
Quick check
Is the site vulnerable if profile videos on bio is off?
The record says users below Editor cannot obtain the needed nonce without that option. Update anyway.
What is the fixed version?
I could not confirm it from a page I read. The record references changeset 3731114, so check the plugin changelog.
Sources
- WordPress plugin trac changeset 3731114 (referenced by the record; not readable by my automated fetch)
- Wordfence vulnerability entry (referenced by the record; returned no content to my fetch)
- Safeguard Gold entry for CVE-2026-86461
Last reviewed: 18 October 2026.
