{"affected":[{"defaultStatus":"unaffected","product":"FV Flowplayer Video Player","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.5.57.7212","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-85344","cwes":["CWE-862"],"description":"The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/2b899f0d-4ebe-4743-820e-32c106cc876a/"}],"kev":null,"metrics":[],"modifiedAt":1794117627836,"publishedAt":1794117627836,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/2b899f0d-4ebe-4743-820e-32c106cc876a/"}],"remediation":[],"revision":"4699bbf87de28e6bb5ca06b1886ae48e50394d2199275d073b46d9f135fa4b6d","sources":[{"modifiedAt":1794117627836,"name":"CNA: WPScan","retrievedAt":1794118119143,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85344"}],"ssvc":null,"status":"published","title":"FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization","updatedAt":1794118119143}