Security Alert Summary
The FV Flowplayer Video Player WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 7.5.56.7212 that allows authenticated users with Contributor-level access and above to supply a URL that the server fetches without proper validation. The fetched response body can be stored and served publicly, and internal resources returned with an image content type may be exposed.
CVE Details
- CVE ID: CVE-2026-85351
- Affected component: FV Flowplayer Video Player WordPress plugin
- Affected versions: Versions before 7.5.56.7212
- Published: November 5, 2026 at 6:17:08 AM UTC
- Last modified: November 5, 2026 at 3:06:27 PM UTC
- CVSS v3.1 base score / severity / vector: Not provided
- Authentication / privileges / user interaction: Requires an authenticated account with Contributor-level access or higher; a user must supply the URL that is fetched by the server.
- Primary impact: Confidentiality – possible disclosure of internal resource responses when returned with an image content type. Integrity – not indicated. Availability – not indicated.
- CWE / weakness ID: Not specified
Technical Details
The plugin does not validate a user-supplied URL before performing a server-side fetch. As a result, an authenticated user with Contributor-level access or above can provide a URL that the server will request on their behalf. The response body of that fetch is stored and served publicly by the plugin.
Because the plugin serves the fetched response when it is returned with an image content type, an attacker with the required role can use the server to read the response of internal resources that would normally be inaccessible from the public internet. This is a Server-Side Request Forgery (SSRF) issue caused by missing validation of external inputs before initiating server-side requests and by serving fetched response bodies without sufficient content-type and origin checks.
The impact described in the advisory is limited to disclosure of fetched responses under the conditions stated; no additional endpoints, functions, or REST API paths are named in the available information.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage content, and external contributors. If a contributor or other user with sufficient privileges can submit or edit content that triggers the plugin to fetch a user-supplied URL, they could cause the site to request internal resources and expose the response when it is returned as an image. This could lead to the unintended disclosure of internal endpoints or data accessible from the web server, and increase the risk of targeted phishing or social engineering if internal information (for example, internal email addresses or other resource data) is exposed.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and above, to minimize who can submit content that triggers server-side requests.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and logs for unusual behavior related to outbound requests or unexpected public content uploads.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
