CVE-2026-85346 json
FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
published 2026-11-05 4 d ago modified 2026-11-06 2 d ago also EUVD-2026-117335
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
Patch / fix
- Unknown FV Flowplayer Video Player 7.5.56.7212
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 d ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Unknown FV Flowplayer Video Player
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
-
wpscan.com
/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/
exploit, vdb-entry, technical-description
Sources
- CVE List CVE-2026-85346
- NVD CVE-2026-85346
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.