The FV Flowplayer Video Player WordPress plugin implementation before version 7.5.57.7212 lacks an authorization check on a specific AJAX action that performs a site‑wide rewrite of post content. As a result, any authenticated user—including those with subscriber tier permissions—can trigger a bulk modification of posts they ordinarily cannot edit. This flaw allows the attacker to alter or replace post content en masse, undermining content integrity and potentially injecting malicious or misleading information.

The vulnerability affects the FV Flowplayer Video Player plugin for WordPress. All installations running any version earlier than 7.5.57.7212 are susceptible. The plugin’s vendor is identified as FV Flowplayer Video Player and belongs to the WordPress ecosystem.

Because the flaw resides in an AJAX endpoint accessed by authenticated users, the attack vector is local to the site’s user authentication system. The absence of a check on this action means an attacker who has valid credentials can immediately trigger mass content changes. While no EPSS score is available and the issue is not yet listed in CISA KEV, the potential impact on content integrity is high for sites that rely on subscriber restrictions to protect post edit rights. Administrators should treat this as a high‑severity flaw for any site that permits subscriber access, as the privilege escalation allows full rewrite of published content.