# CVE-2026-118079: FV Flowplayer Video Player PHP object injection

Source: https://junglewise.ai/threats/cve-2026-118079-shop-manager-php-object-injection-in-fv-flowplayer-video-player  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118079 · Severity: high · CVSS 7.2 · Published 2026-10-29

FV Flowplayer Video Player is a WordPress plugin that embeds video players on websites. A PHP object injection vulnerability in versions 8.3.4 and below allows authenticated shop managers to execute arbitrary code on the web server, potentially compromising the entire website and its data.

Technologies: [FolioVision FV Flowplayer Video Player](https://junglewise.ai/threats/technologies/fv-flowplayer-video-player). Vendors: [FolioVision](https://junglewise.ai/threats/vendors/foliovision).

## Quick answers

**Is CVE-2026-118079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118079 being exploited in the wild.

**How severe is CVE-2026-118079?** High severity, with a CVSS score of 7.2, published 29 October 2026.

**Which products and versions are affected?** FolioVision FV Flowplayer Video Player 8.3.4 and earlier.

**Is there a fix for CVE-2026-118079?** No fixed version is recorded yet. Patchstack has issued a mitigation rule to block exploitation attempts. As an immediate action, contact your hosting provider or web developer for assistance if you cannot disable or remove the plugin, and restrict shop manager role assignments to trusted users only.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118079 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118079?** Check whether you run FolioVision FV Flowplayer Video Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Patchstack has issued a mitigation rule to block exploitation attempts. As an immediate action, contact your hosting provider or web developer for assistance if you cannot disable or remove the plugin, and restrict shop manager role assignments to trusted users only.</anigation>
</invoke>

## Technical details

A PHP object injection flaw in the FV Flowplayer Video Player plugin allows attackers with shop manager privileges to manipulate data processing and execute arbitrary actions on the server. The vulnerability requires authentication as a shop manager and exists in versions 8.3.4 and earlier. No official patch has been released.

## Affected products

- Foliovision FV Flowplayer Video Player 8.3.4 and earlier

## Timeline

- 2026-10-29: disclosed
- 2026-09-17: reported

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [FolioVision FV Flowplayer Video Player stored XSS](https://junglewise.ai/threats/cve-2026-121764-improper-neutralization-of-input-during-web-page-generation)
- [FV Flowplayer Video Player stored XSS in comment parsing](https://junglewise.ai/threats/cve-2026-117525-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57)
- [FV Flowplayer Video Player stored XSS in comment parameter](https://junglewise.ai/threats/cve-2026-121515-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS in profile videos](https://junglewise.ai/threats/cve-2026-110533-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via align attribute](https://junglewise.ai/threats/cve-2026-110001-the-fv-flowplayer-video-player-plugin-for-wordpress-is)