{"metadata": {"vulnerability": "CVE-2026-83526", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-08-31T16:16:13.303Z", "date_only": false, "value": "2026-08-31T16:16:13.303Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-83526", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-02T15:44:33Z", "date_only": false, "value": "2026-09-02T15:44:33.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-83526", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-09T17:08:42Z", "date_only": false, "value": "2026-10-09T17:08:42.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-83526", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-10T05:30:58.064Z", "date_only": false, "value": "2026-10-10T05:30:58.064Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-83526", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T05:30:58.064Z", "date_only": false, "value": "2026-10-10T05:30:58.064Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-83526", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T05:53:53.549Z", "date_only": false, "value": "2026-10-10T05:53:53.549779Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117415059977309974", "record": "CVE-2026-83526", "field": "creation_timestamp", "uuid": "f99b3ac9-8f1e-4136-8cc7-1e9d84114a89", "content": "CVE-2026-83526 FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition.\nhttps://www.cve.org/CVERecord?id=CVE-2026-83526https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=cvehttps://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L105https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L148https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/checker.php#L181https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L46https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1102https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db.php#L1173https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/db-video.php#L855https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php#L36https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/frontend.php#L1211https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8#wordpress #foliovision #FVPlayer8#CVE_2026_83526#bot", "url": "https://infosec.exchange/users/cve/statuses/117415059977309974"}, {"timestamp": "2026-10-10T06:16:43Z", "date_only": false, "value": "2026-10-10T06:16:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P776-3XX4-5FCG", "record": "GHSA-P776-3XX4-5FCG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T06:16:43.340Z", "date_only": false, "value": "2026-10-10T06:16:43.340", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-83526", "record": "FKIE_CVE-2026-83526", "field": "published"}, {"timestamp": "2026-10-10T06:30:59Z", "date_only": false, "value": "2026-10-10T06:30:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P776-3XX4-5FCG", "record": "GHSA-P776-3XX4-5FCG", "field": "published"}, {"timestamp": "2026-10-10T06:30:59Z", "date_only": false, "value": "2026-10-10T06:30:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P776-3XX4-5FCG", "record": "GHSA-P776-3XX4-5FCG", "field": "modified"}, {"timestamp": "2026-10-11T16:43:03.315Z", "date_only": false, "value": "2026-10-11T16:43:03.315494Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-83526", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T16:43:03.315Z", "date_only": false, "value": "2026-10-11T16:43:03.315494Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-83526", "record": "FKIE_CVE-2026-83526", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T16:55:17.940Z", "date_only": false, "value": "2026-10-11T16:55:17.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-83526", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T16:55:17.940Z", "date_only": false, "value": "2026-10-11T16:55:17.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-83526", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:29:12.567Z", "date_only": false, "value": "2026-10-13T13:29:12.567", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-83526", "record": "FKIE_CVE-2026-83526", "field": "lastModified"}]}