SSRF Vulnerability in FV Flowplayer Video Player WordPress Plugin

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212. Users with Contributor-level access or higher can supply a malicious URL to the plugin's media library import feature. The plugin fetches content from the URL without proper validation, stores the response, and serves it publicly. If the fetched resource is an internal file with an image content type, attackers can read its contents.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of the FV Flowplayer Video Player plugin in your WordPress site. If the version is below 7.5.56.7212, the system is vulnerable. You can verify the version via the WordPress admin panel under Plugins or by inspecting the plugin files on the server.

Useful 0 Not Useful 0

Impact Analysis

Attackers with Contributor-level access or higher could exploit this to read sensitive internal data by fetching and exposing internal resources that return an image content type. This could lead to unauthorized access to confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access to internal resources could result in data breaches and non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the FV Flowplayer Video Player plugin to version 7.5.56.7212 or later. Remove or disable the plugin if an update is not available. Review user roles with Contributor-level access or higher to ensure they are trusted, as they could exploit this vulnerability.

Useful 0 Not Useful 0