CVE-2026-85346 Details
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
A vulnerability exists in the FV Flowplayer Video Player WordPress plugin in versions prior to 7.5.56.7212. The issue arises because the plugin fails to implement proper authorization or Cross-Site Request Forgery (CSRF) protections on several cloud storage media browser handlers. This oversight allows any authenticated user with minimal permissions, such as a Subscriber, to access and disclose the configuration and file listings from the site's connected cloud storage accounts.
Users are advised to update the FV Flowplayer Video Player WordPress plugin to version 7.5.56.7212 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| FV Flowplayer Video Player | < 7.5.56.7212 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |