---
id: CVE-2026-85351
title: FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
summary: >-
  The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not
  validate a user-supplied URL before performing a server-side fetch whose
  response body is stored and served publicly, allowing users with
  Contributor-level acces…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-918
product: FV Flowplayer Video Player
affected:
  - fv_flowplayer_video_player < 7.5.56.7212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T11:52:14.926175Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:05:20.401Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85351'
references:
  - url: 'https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02816
ingestedAt: '2026-11-05T21:36:00.778Z'
---

## Overview

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.

## Affected

- `fv_flowplayer_video_player < 7.5.56.7212`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.