WordPress FV Player Arbitrary File Upload via MIME Validation Bypass

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The FV Player 8 plugin for WordPress contains a critical arbitrary file upload vulnerability in versions through 8.1.7 that allows authenticated subscribers and higher to upload malicious files to the server's public directory. The vulnerability stems from the check_mimetype() function failing to validate file types before writing attacker-controlled remote content to disk, combined with missing capability checks on player creation. This means threat actors with minimal WordPress access can bypass security controls and place executable code on web-accessible directories, potentially leading to complete server compromise. Any WordPress installation using FV Player 8.1.7 or earlier with subscriber registration enabled faces immediate risk of exploitation.

Casky's 447 mapped security skills leverage Claude's reasoning capabilities to detect the multi-stage attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002) phases. A practitioner using Casky would identify suspicious patterns including: unauthorized file writes to wp-content/uploads with executable MIME types despite validation functions, HTTP POST requests to plugin endpoints with mismatched Content-Type headers, and creation of new player instances by low-privilege accounts without capability verification. The platform's skills would surface evidence of Resource Development activities like external file staging, followed by execution indicators such as PHP file access or suspicious wp-load includes, enabling defenders to catch the full attack chain rather than isolated events.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-83526.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-83526

Casky has 447 skills that investigate the attack patterns behind CVE-2026-83526. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn