Authorization Bypass in FV Flowplayer Video Player Plugin for WordPress
CVE-2026-85346
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-85346?
The FV Flowplayer Video Player plugin for WordPress is vulnerable due to a lack of proper authorization and CSRF checks in its cloud storage media browser handlers. This issue allows authenticated users with minimal permissions, such as Subscribers, to disclose sensitive configurations and file listings associated with the cloud storage accounts connected to the site. Website administrators should urgently apply updates to mitigate the risk of unauthorized access and information disclosure.
Affected Version(s)
FV Flowplayer Video Player 0 < 7.5.56.7212
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.