---
id: "CVE-2026-85346"
kind: "vulnerability"
aliases: ["CVE-2026-85346"]
title: "WordPress FV Flowplayer plugin: subscribers can view cloud storage file listings"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fv-flowplayer", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-cloud-storage-connected", "open-registration-disabled", "plugin-not-installed"]
published_at: "2026-11-05T06:17:08+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85346", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# WordPress FV Flowplayer plugin: subscribers can view cloud storage file listings

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 lacks authorization and CSRF checks on several cloud storage media browser handlers. Any logged-in user, even a Subscriber, can read the configuration and file listings of the site's connected cloud storage accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin Plugins screen; versions before `7.5.56.7212` are affected.
- Review whether cloud storage accounts (for example Dropbox or Google Drive) are connected to the plugin's media browser.

## Fix

- FV Flowplayer Video Player: move to `7.5.56.7212` or later.

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85346

## From the sources

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_