CVE-2026-85346 FV Flowplayer CVE debrief

Who should care

Defenders and administrators of WordPress sites using the FV Flowplayer Video Player plugin should assess exposure and verify access controls to prevent potential disclosure of cloud storage configuration and file listings. They should also limit permissions for users with minimal access and monitor for suspicious activity on cloud storage accounts.

Why it matters

CVE-2026-85346 allows authenticated users with minimal permissions to disclose cloud storage configuration and file listings, requiring defenders to verify access controls and user permissions.

• Potential disclosure of cloud storage configuration and file listings
• Possible unauthorized access to sensitive information
• Need for verification of access controls and user permissions
• Potential for lateral movement or exploitation by authenticated users

Technical summary

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 lacks authorization and CSRF checks on cloud storage media browser handlers, allowing authenticated users with minimal permissions to disclose configuration and stored file listings. This vulnerability can be mitigated by verifying and restricting access to cloud storage media browser handlers, especially for users with minimal permissions, and by monitoring for suspicious activity on cloud storage accounts. The vulnerability requires defenders to assess exposure and verify access controls.

Defensive priority

Defenders should prioritize verifying and restricting access to cloud storage media browser handlers, especially for users with minimal permissions.

Recommended defensive actions

• Verify and restrict access to cloud storage media browser handlers
• Limit permissions for users with minimal access
• Monitor for suspicious activity on cloud storage accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Further verification is needed to determine the full scope of affected systems and to confirm the accuracy of the provided information. The vulnerability highlights the importance of proper authorization and CSRF checks in cloud storage media browser handlers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.