CVE-2026-85351 FV Flowplayer Video Player CVE debrief

Who should care

Defenders responsible for WordPress installations with the FV Flowplayer Video Player plugin, especially those with Contributor-level access or higher, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2026-85351 because it allows SSRF attacks and potential data leakage in WordPress installations with the FV Flowplayer Video Player plugin, especially those with Contributor-level access or higher.

• Potential unauthorized access to internal resources
• Possible data leakage through SSRF attacks
• Need for verification of plugin version and exposure
• Priority on restricting access to prevent exploitation

Technical summary

The FV Flowplayer Video Player WordPress plugin is vulnerable to Server-Side Request Forgery (SSRF) attacks due to lack of validation on user-supplied URLs, allowing users with Contributor-level access and above to perform SSRF attacks and to read the response of an internal resource when it is returned with an image content type. This vulnerability can lead to potential unauthorized access to internal resources and possible data leakage through SSRF attacks, emphasizing the need for defenders to prioritize verifying exposure of the FV Flowplayer Video Player WordPress plugin in their environment.

Defensive priority

Defenders should prioritize verifying exposure of the FV Flowplayer Video Player WordPress plugin in their environment, especially for servers with Contributor-level access or higher.

Recommended defensive actions

• Verify the FV Flowplayer Video Player WordPress plugin version in use and check for updates
• Restrict Contributor-level access and above to prevent SSRF attacks
• Monitor server-side requests and responses for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is needed to confirm affected versions and remediation. Defenders should verify the FV Flowplayer Video Player WordPress plugin version in use, check for updates, and monitor server-side requests and responses for suspicious activity. The vulnerability allows SSRF attacks and potential data leakage in WordPress installations with the FV Flowplayer Video Player plugin, especially those with Contributor-level access or higher.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.