Vulnerability · Published Oct 14, 2026 · Assigned by WPScan

CVE-2026-85345FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data

Medium 4.1

In plain English

A medium-severity server-side request forgery in FV Flowplayer Video Player from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.

Affected products (as reported)

Vendor	Product	Versions
Unknown	FV Flowplayer Video Player	7.5.44.7212 – before 7.5.55.7212

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/d1a5d12d-a7ce-43e1-b7c5-752453bc97e9/ exploit, vdb-entry, technical-description