CVE-2026-85345: CWE-918 Server-Side Request Forgery (SSRF) in FV Flowplayer Video Player

CVE-2026-85345 is a CWE-918 Server-Side Request Forgery vulnerability in the FV Flowplayer Video Player WordPress plugin. Versions >=7.5.44.7212 and <7.5.55.7212 improperly validate URLs supplied by users before fetching them server-side. Additionally, the existing host-based restrictions do not cover all cases, enabling users with Contributor-level or higher privileges to perform SSRF attacks. The SSRF is semi-blind: the attacker can determine if an internal resource responds and see its HTTP status code, but cannot retrieve the resource's content.

An attacker with Contributor-level or higher access can exploit this vulnerability to cause the server to make HTTP requests to internal or otherwise restricted network resources. This can be used to probe internal services and infer their availability and status codes. However, the attacker cannot obtain the content of the internal resources, limiting the impact to information disclosure about resource existence and status rather than data exfiltration.

No explicit patch or remediation details are provided in the available data. Since the vulnerability affects specific plugin versions, upgrading to version 7.5.55.7212 or later (if available) is recommended once confirmed. Until then, restrict Contributor-level user privileges where possible and monitor for unusual server-side fetch activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.