CVE-2026-85346: FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers

Q: Who can exploit this issue?

Any authenticated WordPress user with minimal permissions, including a Subscriber, can exploit the affected media browser handlers. An attacker does not need administrative privileges.

Q: What information can be disclosed?

The issue can expose configuration details and stored file listings for cloud storage accounts connected to the site through the plugin. The provided information does not state that file contents themselves can be downloaded.

Q: Are sites without connected cloud storage accounts affected?

The disclosed data concerns the site's connected cloud storage accounts. If no cloud storage account is connected through the plugin, there may be no cloud-storage configuration or file listings available to disclose.

Q: What version addresses the issue?

Update FV Player to version 7.5.56.7212 or later. Versions before 7.5.56.7212 are affected.

Published Nov 5, 2026

Updated

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FV Player to a version that resolves this vulnerability.
Fixed in 7.5.56.7212

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with minimal permissions, including a Subscriber, can exploit the affected media browser handlers. An attacker does not need administrative privileges.

What information can be disclosed?

The issue can expose configuration details and stored file listings for cloud storage accounts connected to the site through the plugin. The provided information does not state that file contents themselves can be downloaded.

Are sites without connected cloud storage accounts affected?

The disclosed data concerns the site's connected cloud storage accounts. If no cloud storage account is connected through the plugin, there may be no cloud-storage configuration or file listings available to disclose.

What version addresses the issue?

Update FV Player to version 7.5.56.7212 or later. Versions before 7.5.56.7212 are affected.

CVE-2026-85346: FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Are sites without connected cloud storage accounts affected?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Are sites without connected cloud storage accounts affected?

What version addresses the issue?