{"id":"CVE-2026-85351","kind":"vulnerability","aliases":["CVE-2026-85351"],"related":[],"title":"FV Flowplayer WordPress plugin: contributors can read internal server responses","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","summary":"The FV Flowplayer Video Player WordPress plugin fetches a user-supplied URL on the server without validating it, and stores the response publicly. A user with Contributor-level access or higher can use this to make the server request internal resources and read what comes back when the content type is an image.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed","plugin-version-fixed"],"how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin under Plugins; unknown whether the sources give a specific check beyond this.\n- Confirm whether Contributor-level or higher accounts can create or edit posts on the site.","fix":"- FV Flowplayer Video Player plugin: move to `7.5.56.7212` or later.","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:08+00:00","updated_at":"2026-11-05T06:33:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:08Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player plugin: move to `7.5.56.7212` or later.","reach":"network","title":"FV Flowplayer WordPress plugin: contributors can read internal server responses","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin fetches a user-supplied URL on the server without validating it, and stores the response publicly. A user with Contributor-level access or higher can use this to make the server request internal resources and read what comes back when the content type is an image.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"internal server resources readable by a contributor account","analyst_note":"","how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin under Plugins; unknown whether the sources give a specific check beyond this.\n- Confirm whether Contributor-level or higher accounts can create or edit posts on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-fixed","no-contributor-accounts"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 where users with Contributor-level access or higher can submit content. Sites without this plugin, or where only trusted administrators can post, are less exposed. The sources do not say whether managed WordPress hosts are affected differently.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4250,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85351':13A,16A '7.5.56.7212':88C 'access':55B,118C 'allow':112C 'attack':129C 'back':72B 'bodi':106C 'come':71B 'content':75B,146C 'contributor':5A,53B,116C 'contributor-level':52B,115C 'cve':11A,14A 'fetch':32B,103C 'flowplay':2A,19B,27B,82C 'forgeri':127C 'fv':1A,18B,26B,81C 'fv-flowplay':17B 'higher':57B 'host':23B 'imag':79B,145C 'intern':8A,66B,137C 'level':54B,117C 'make':62B 'packag':20B 'perform':98C,122C 'player':29B,84C 'plugin':4A,31B,86C 'public':48B,111C 'read':7A,69B,132C 'request':65B,126C 'resourc':67B,138C 'respons':10A,47B,105C,134C 'return':142C 'self':22B 'self-host':21B 'serv':110C 'server':9A,40B,64B,101C,124C 'server-sid':100C,123C 'side':102C,125C 'ssrf':128C 'store':45B,108C 'suppli':36B,95C 'type':76B,147C 'url':37B,96C 'use':59B 'user':35B,50B,94C,113C 'user-suppli':34B,93C 'valid':42B,91C 'video':28B,83C 'whose':104C 'without':41B 'wordpress':3A,24B,30B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 where users with Contributor-level access or higher can submit content. Sites without this plugin, or where only trusted administrators can post, are less exposed. The sources do not say whether managed WordPress hosts are affected differently.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85351","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}