CVE-2026-85346 json
FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
published 6d ago modified 5d ago also EUVD-2026-117335
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
Patch / fix
- Unknown FV Flowplayer Video Player 7.5.56.7212
Is CVE-2026-85346 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5d ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Unknown FV Flowplayer Video Player
Classification
- Weakness
- Technology feeds
References
-
wpscan.com
/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7/
exploit, vdb-entry, technical-description
Sources
- CVE List CVE-2026-85346
- NVD CVE-2026-85346
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.