The FV Flowplayer Video Player WordPress plugin contains a flaw that allows attackers with Contributor‑level access or higher to supply a crafted URL. The plugin fails to validate the URL and bypasses host‑based restrictions, enabling a server‑side request forgery. The resulting request only reveals whether an internal resource responds and its HTTP status, so it is a semi‑blind oracle rather than a content leak.

Older versions of the FV Flowplayer Video Player WordPress plugin, specifically any release before 7.5.55.7212, are vulnerable. The flaw can affect any site that has the plugin enabled and grants Contributor or higher roles to users.

The CVSS score of 4.1 indicates moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. An attacker would need to be able to authenticate to the WordPress backend as a Contributor or higher and then craft a request to the retrieve_video_data endpoint. The attack requires only the ability to supply a URL; the responses provide a semi‑blind oracle about internal resources.