Description
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the "Enable profile videos" setting is enabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
foliovision FV Player 8
Default version status: unaffected
0 to ≤ 8.1.7affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cve ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36 ↗
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211 ↗
- https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8 ↗