{"affected":[{"defaultStatus":"unaffected","product":"FV Flowplayer Video Player","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.5.56.7212","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-108067","cwes":["CWE-639"],"description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/46aca27e-580a-4bb6-895c-dae238629d4f/"}],"kev":null,"metrics":[],"modifiedAt":1793772024877,"publishedAt":1793772024877,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/46aca27e-580a-4bb6-895c-dae238629d4f/"}],"remediation":[],"revision":"43a720f76eca350ab4ff648c765c0dc115266ca736e021d5514f812d324f6f9a","sources":[{"modifiedAt":1793772024877,"name":"CNA: WPScan","retrievedAt":1793776119936,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108067"}],"ssvc":null,"status":"published","title":"FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR","updatedAt":1793776119936}