FV Flowplayer CVE-2026-85345

Exploitation requires an authenticated WordPress account at Contributor level or higher on a site running FV Flowplayer Video Player in the 7.5.44.7212 to <7.5.55.7212 range, and use of the plugin's URL-based server-side video/media fetch feature where an attacker-controlled URL is submitted. The limiting factors are significant: it is authenticated-only (so sites that do not grant untrusted users Contributor access, i.e., most single-author installs, are largely out of reach), the existing host-based restriction blocks some but not all cases, and the impact is confined to a semi-blind oracle - the attacker learns only whether an internal resource responds and its HTTP status, not the response body - so this is useful for internal network/service reconnaissance rather than direct data theft.

This is a genuinely low-priority issue despite being a confirmed, patched vulnerability with public exploit code. The signals align consistently toward low real-world risk: the CVSS base score is only 4.1 (Medium), EPSS is 0.16% (5th percentile), and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial' - none of which indicate urgency. It is NOT in CISA KEV. The most important caveat is a conflict in the authentication signal: the CVSS vector specifies PR:H (high privilege), but the description states exploitation requires only 'Contributor-level access and above,' which in WordPress is a LOW-privilege authenticated role - the vector appears to overstate the privilege barrier and PR:L would be more accurate. Either way, exploitation requires an authenticated account on the site, which substantially limits exposure to multi-author/membership blogs rather than typical single-admin installs. The impact is also inherently capped: this is explicitly a semi-blind SSRF oracle (C:L, I:N, A:N) that only reveals whether an internal resource responds and its HTTP status - response bodies are not returned, so it cannot directly exfiltrate data or reach sensitive content on its own. Public exploit code exists (WPScan), but that is distinct from active exploitation, which no source confirms. Net: a real but low-severity bug best handled via routine patching, not emergency response.

An attacker who holds (or phishes/registers) a Contributor-level WordPress account on a site running the vulnerable plugin supplies a crafted URL pointing at an internal address (e.g., a cloud metadata endpoint or an intranet host) to the plugin's server-side fetch feature, bypassing the incomplete host-based restriction. Because AC:L and UI:N, the request requires no special timing or victim interaction; the server's differing responses/HTTP status codes let the attacker map which internal resources exist and are reachable. A public proof-of-concept is available via WPScan, lowering the barrier to reproduction.