CVE-2026-85345
Received
Received - Intake
Server-Side Request Forgery in FV Flowplayer Video Player
Vulnerability report for CVE-2026-85345, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: WPScan
Description
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Unknown | FV | Flowplayer Video Player 7.5.44.7212 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
