CVE-2026-85351: FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import

Q: Who can exploit this issue?

A WordPress user with Contributor-level access or higher can exploit it. The vulnerable plugin must be installed at a version before 7.5.56.7212.

Q: What can an attacker access through the SSRF flaw?

The attacker can cause the server to fetch a user-supplied URL. They can read the response when the targeted internal resource returns an image content type, because the response body is stored and served publicly.

Q: How can I tell whether my site is affected?

Check whether FV Flowplayer Video Player is installed and whether its version is earlier than 7.5.56.7212. Also review whether Contributor or higher roles are assigned to untrusted users, since those roles can invoke the vulnerable functionality.

Published Nov 5, 2026

Updated

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A WordPress user with Contributor-level access or higher can exploit it. The vulnerable plugin must be installed at a version before 7.5.56.7212.

What can an attacker access through the SSRF flaw?

The attacker can cause the server to fetch a user-supplied URL. They can read the response when the targeted internal resource returns an image content type, because the response body is stored and served publicly.

How can I tell whether my site is affected?

Check whether FV Flowplayer Video Player is installed and whether its version is earlier than 7.5.56.7212. Also review whether Contributor or higher roles are assigned to untrusted users, since those roles can invoke the vulnerable functionality.

CVE-2026-85351: FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker access through the SSRF flaw?

How can I tell whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker access through the SSRF flaw?

How can I tell whether my site is affected?