CVE-2024-32955 MEDIUM

CVE-2024-32955: WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

Vendor Foliovision
Product FV Flowplayer Video Player
Weakness CWE-918 · SSRF
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.

Explanation of Vulnerability in Simple Terms

02Summary

FV Flowplayer Video Player versions up to 7.5.43.7212 contain a server-side request forgery vulnerability. An authenticated user with low privileges can craft requests that cause the server to make HTTP requests to internal or external systems on the attacker's behalf. The scope is changed, meaning the impact may extend beyond the video player component itself.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers under the attacker's control.

Potential impact on your site

04Site Impact

An authenticated attacker can probe your internal network, access internal services, or interact with external systems as if the request came from your server.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; no user interaction required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57372 WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery CVE-2026-60033 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 CVE-2026-39695 WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-6812 Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter