FV Player 8 for WordPress is vulnerable to arbitrary file upload in all versions up to and including 8.1.7 via the check_mimetype function. This arises from insufficient file type validation that writes attacker‑supplied remote file content to the public uploads directory before any MIME or extension check, along with a missing capability check when creating new players. As a result, authenticated borrowers with subscriber‑level access or higher can upload files that may be executable, enabling remote code execution. Successful exploitation requires a race condition and the presence of the '[fvplayer_editor]' shortcode or the "Enable profile videos" setting.

WordPress sites that use the Foliovision FV Player 8 plugin in any release up to and including version 8.1.7 are affected. The vulnerability is present in all prior versions of the plugin, with the issue fixed starting in release 8.1.8.

The vulnerability carries a CVSS score of 8.8, placing it in the High severity range. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a subscriber or higher and to manipulate the race condition during file upload. Because only authenticated users can trigger the flaw, the likelihood of exploitation in environments where subscriber accounts are widely available remains moderate to high, and successful exploitation can provide full remote execution on the underlying web server.