{"id":"CVE-2026-85345","aliases":["EUVD-2026-100852","GHSA-f2mj-x2jj-wjvc"],"status":"published","title":"FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00229,"percentile":0.13774,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-10-14T06:00:13Z","modified":"2026-10-14T16:14:02Z","products":[{"vendor":"fv flowplayer video player","product":"fv flowplayer video player"},{"vendor":"unknown","product":"fv flowplayer video player"}],"references":[{"url":"https://wpscan.com/vulnerability/d1a5d12d-a7ce-43e1-b7c5-752453bc97e9/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85345"},{"url":"https://wpscan.com/vulnerability/d1a5d12d-a7ce-43e1-b7c5-752453bc97e9"},{"url":"https://github.com/advisories/GHSA-f2mj-x2jj-wjvc"}],"sources":{"cve":[{"id":"CVE-2026-85345","title":"FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.","status":"published","published":"2026-10-14T06:00:13.06Z","modified":"2026-10-14T13:42:21.808Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-100852","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.","status":"published","published":"2026-10-14T06:00:13Z","modified":"2026-10-14T13:42:21Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:15.581093Z"}],"ghsa":[{"id":"GHSA-f2mj-x2jj-wjvc","title":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a...","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.","status":"published","published":"2026-10-14T09:31:32Z","modified":"2026-10-14T15:32:19Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:13:25.439244Z"}],"nvd":[{"id":"CVE-2026-85345","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.","status":"published","published":"2026-10-14T07:17:03.53Z","modified":"2026-10-14T16:14:02.8Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:58.99337Z"}]}}