CVE-2026-85345 FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
Contributors can exploit SSRF in FV Flowplayer to probe internal resources and determine their availability via HTTP status codes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85345?
CVE-2026-85345 is a medium-severity server-side request forgery vulnerability in Unknown FV Flowplayer Video Player, published on 14 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
Weakness: CWE-918
Which versions are affected by CVE-2026-85345?
How do I fix CVE-2026-85345?
No fix has been published for CVE-2026-85345 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-85345 being exploited?
There is no known exploitation of CVE-2026-85345 in the wild and no public exploit code.
Sources
Also known as GHSA-f2mj-x2jj-wjvc.