The FV Flowplayer Video Player plugin for WordPress suffers from a limited arbitrary file upload flaw. The check_mimetype function performs insufficient MIME type and file extension validation, which can be bypassed. As a result, authenticated users with at least subscriber access can upload files containing executable code. Once uploaded, these files can be accessed and executed on the site, enabling remote code execution. The flaw is amplified when the 'profile videos on bio' option is enabled, because it emits a nonce on the subscriber‑accessible profile page, allowing the upload request to pass authentication checks.

Affecting all plugin versions up to and including 7.5.54.7212, the vulnerability impacts WordPress sites that use the FV Flowplayer Video Player plugin provided by foliovision. Sites with the 'profile videos on bio' feature enabled expose themselves to the risk; any WordPress user with subscriber-level privileges can trigger the exploit. No specific version beyond 7.5.54.7212 is reported to be unaffected, so any deployment of the plugin prior to this release remains vulnerable.

The CVSS score of 8.8 indicates a high‑severity flaw, and the lack of an EPSS score suggests limited publicly documented exploitation activity to date. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the upload component to be enabled and the profile‑video option to be active, so sites that have disabled that setting mitigate risk until a patch is applied. However, if the setting is active, an attacker with subscriber access can upload arbitrary files and achieve remote code execution.