{"id":"CVE-2026-85346","kind":"vulnerability","aliases":["CVE-2026-85346"],"related":[],"title":"WordPress FV Flowplayer plugin: subscribers can view cloud storage file listings","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 lacks authorization and CSRF checks on several cloud storage media browser handlers. Any logged-in user, even a Subscriber, can read the configuration and file listings of the site's connected cloud storage accounts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","wordpress","wordpress-plugin"],"not_affected_if":["no-cloud-storage-connected","open-registration-disabled","plugin-not-installed"],"how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin Plugins screen; versions before `7.5.56.7212` are affected.\n- Review whether cloud storage accounts (for example Dropbox or Google Drive) are connected to the plugin's media browser.","fix":"- FV Flowplayer Video Player: move to `7.5.56.7212` or later.","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:10+00:00","updated_at":"2026-11-05T06:33:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:10Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player: move to `7.5.56.7212` or later.","reach":"internet","title":"WordPress FV Flowplayer plugin: subscribers can view cloud storage file listings","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 lacks authorization and CSRF checks on several cloud storage media browser handlers. Any logged-in user, even a Subscriber, can read the configuration and file listings of the site's connected cloud storage accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","fv-flowplayer"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege users read cloud storage configuration and file listings","analyst_note":"","how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin Plugins screen; versions before `7.5.56.7212` are affected.\n- Review whether cloud storage accounts (for example Dropbox or Google Drive) are connected to the plugin's media browser.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-cloud-storage-connected","open-registration-disabled"],"who_is_affected":"Sites running the FV Flowplayer Video Player plugin before 7.5.56.7212 that have cloud storage accounts connected to its media browser. Any account with a low-privilege role such as Subscriber, including self-registered users if registration is open, can reach the affected handlers. Sites without the plugin or without connected cloud storage are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4242,"output_tokens":628,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85346':14A,17A '7.5.56.7212':34B,78C 'account':69B,120C 'allow':95C 'authent':97C 'author':36B,82C 'browser':45B,93C 'check':39B,85C 'cloud':8A,42B,67B,90C,118C 'configur':58B,108C 'connect':66B,117C 'csrf':38B,84C 'cve':12A,15A 'disclos':106C 'even':52B 'file':10A,60B,111C 'flowplay':3A,20B,28B,72C 'fv':2A,19B,27B,71C 'fv-flowplay':18B 'handler':46B,94C 'lack':35B 'list':11A,61B,112C 'log':49B 'logged-in':48B 'media':44B,92C 'minim':100C 'packag':21B 'perform':81C 'permiss':101C 'player':30B,74C 'plugin':4A,25B,32B,76C 'read':56B 'sever':41B,87C 'site':64B,115C 'storag':9A,43B,68B,91C,119C 'store':110C 'subscrib':5A,54B,104C 'user':51B,98C 'video':29B,73C 'view':7A 'wordpress':1A,22B,24B,31B,75C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player plugin before 7.5.56.7212 that have cloud storage accounts connected to its media browser. Any account with a low-privilege role such as Subscriber, including self-registered users if registration is open, can reach the affected handlers. Sites without the plugin or without connected cloud storage are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85346","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}