{"affected":[{"defaultStatus":"unaffected","product":"FV Flowplayer Video Player","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.5.56.7212","status":"affected","version":"7.4.44.727","versionType":"semver"}]}],"cveId":"CVE-2026-108068","cwes":["CWE-862"],"description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/22aec931-839e-4b2e-bb40-6d00e58706ee/"}],"kev":null,"metrics":[],"modifiedAt":1793772025050,"publishedAt":1793772025050,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/22aec931-839e-4b2e-bb40-6d00e58706ee/"}],"remediation":[],"revision":"cb4d3882c03b9c91c4ef4ea4acd736fe418b06c205766dfa15f1a04541016c06","sources":[{"modifiedAt":1793772025050,"name":"CNA: WPScan","retrievedAt":1793776121064,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108068"}],"ssvc":null,"status":"published","title":"FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard","updatedAt":1793776121064}