CVE-2026-83526: CWE-434 Unrestricted Upload of File with Dangerous Type in foliovision FV Player 8

The FV Player 8 WordPress plugin is vulnerable to arbitrary file upload due to insufficient validation in the check_mimetype() function. This function writes attacker-supplied remote file content to the public uploads directory before performing MIME or extension checks. Furthermore, there is a missing capability check on new player creation, allowing authenticated users with subscriber-level privileges or higher to upload files that may be executable. Exploitation requires successfully exploiting a race condition, which could lead to remote code execution. All versions up to and including 8.1.7 are affected.

An authenticated attacker with subscriber-level access or higher can upload arbitrary files, including potentially executable ones, to the public uploads directory. This can lead to remote code execution on the affected system if the race condition is successfully exploited. The vulnerability compromises confidentiality, integrity, and availability of the affected system, as reflected by the CVSS vector indicating high impact on all three.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to prevent untrusted users from uploading files and monitor for suspicious upload activity. Avoid granting subscriber-level or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary mitigation.