CVE-2026-85346 · Package
NO FIX YET · SEE WHAT TO DO
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 lacks authorization and CSRF checks on several cloud storage media browser handlers. Any logged-in user, even a Subscriber, can read the configuration and file listings of the site's connected cloud storage accounts.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the FV Flowplayer Video Player plugin before 7.5.56.7212 that have cloud storage accounts connected to its media browser. Any account with a low-privilege role such as Subscriber, including self-registered users if registration is open, can reach the affected handlers. Sites without the plugin or without connected cloud storage are not affected.
Not affected if no-cloud-storage-connected, open-registration-disabled, plugin-not-installed
Who cares fv-flowplayer, wordpress, wordpress-plugin
7.5.56.7212 are affected.7.5.56.7212 or later.The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.