4.3
Medium
CVE-2026-85346 FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FV Flowplayer Video Player 7.5 | earliest → < 7.5.56.7212 | 7.5.56.7212 |
Other CVEs of FV Flowplayer Video Player
The 6 CVEs of FV Flowplayer Video Player →
CVE-2026-85351
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
5.0
Medium
CVE-2026-85347
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
6.8
Medium
CVE-2026-108068
FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard
3.8
Low
CVE-2026-108067
FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
3.8
Low