---
id: CVE-2026-85346
title: >-
  FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media
  Browser Handlers
summary: >-
  The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not
  perform authorization or CSRF checks on several of its cloud storage media
  browser handlers, allowing any authenticated user with minimal permissions
  (such as Su…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-862
  - CWE-352
product: FV Flowplayer Video Player
affected:
  - fv_flowplayer_video_player < 7.5.56.7212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T11:52:31.604984Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:05:49.383Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85346'
references:
  - url: 'https://wpscan.com/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/'
tags:
  - cve.org
epss: 0.00097
epssPercentile: 0.00735
ingestedAt: '2026-11-05T21:36:00.778Z'
---

## Overview

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.

## Affected

- `fv_flowplayer_video_player < 7.5.56.7212`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.