CVE-2026-118079 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 10/29/2026
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as CVE-2023-XXXXX, affecting the FV Flowplayer Video Player for WordPress prior to version 8.3.5, represents a critical server-side security flaw rooted in improper handling of user-supplied input within the plugin's administrative interface. This specific instance is classified under CWE-470, which denotes Information Exposure Through Unsafe Reflection or PHP Object Injection vulnerabilities where an attacker can manipulate serialized objects to execute arbitrary code on the target system. The core technical issue arises from the application's failure to properly validate and sanitize data passed through HTTP requests before it is processed by internal functions that utilize unserialization mechanisms. In many WordPress plugins, including this one, administrative settings or media configurations are often stored in a serialized format within the database for efficient retrieval and management. When these values are retrieved without strict type checking or whitelisting of allowed classes, an authenticated attacker with shop manager privileges can inject maliciously crafted PHP objects into these fields.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution (RCE). By exploiting the PHP Object Injection flaw, a threat actor who has been granted the role of Shop Manager in a WooCommerce-integrated environment or similar administrative context can construct serialized payloads containing instances of classes that have magic methods such as __destruct(), __wakeup(), or __toString(). When the vulnerable plugin processes these injected objects during normal operation, it instantiates them and triggers their respective magic methods. If the payload includes references to sensitive system functions or utilizes gadget chains available in the WordPress core or other installed plugins, the attacker can achieve arbitrary command execution on the web server hosting the application. This effectively compromises the confidentiality, integrity, and availability of the entire website infrastructure, allowing for data exfiltration, defacement, or further lateral movement within the network environment.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques like PowerShell (T1059.001) or Windows Command Shell (T1059.004), depending on the underlying operating system of the web server. The exploitation path typically involves Initial Access via valid credentials obtained through phishing or credential stuffing, followed by Privilege Escalation if the Shop Manager role does not have sufficient restrictions to prevent access to vulnerable plugin settings. Once inside, the attacker leverages this vulnerability for Execution and potentially Persistence by modifying site configurations to maintain backdoor access. The lack of input validation is a classic example of CWE-20 Improper Input Validation, which serves as the root cause allowing the injection payload to bypass security controls intended to restrict object instantiation to safe classes only.
Mitigation strategies must focus on immediate patching and rigorous configuration hardening. Administrators running versions 8.3.4 or earlier should upgrade immediately to version 8.3.5 or later, where the developers have implemented proper sanitization of input data before it is passed to any unserialization functions. This typically involves using WordPress's built-in escaping mechanisms such as esc_attr() for output and sanitize_text_field() for input processing, ensuring that only expected data types are accepted. Additionally, organizations should enforce strict least-privilege principles by auditing user roles within the WordPress dashboard. The Shop Manager role should be reviewed to ensure it does not possess unnecessary capabilities related to plugin configuration or file editing unless absolutely required. Implementing a Web Application Firewall (WAF) can also provide an additional layer of defense by detecting and blocking requests containing known malicious serialized payloads or suspicious patterns associated with PHP object injection attempts, although this is considered a compensating control rather than a primary fix. Regular security audits and code reviews focusing on serialization practices are essential to prevent similar vulnerabilities in future updates or custom integrations.