CVE-2024-7727: HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vpajaxhandler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7727?
CVE-2024-7727 has a medium severity level due to unauthorized data access risks.
How can I fix CVE-2024-7727?
To fix CVE-2024-7727, update the HTML5 Video Player plugin to version 2.5.33 or later.
What versions are affected by CVE-2024-7727?
CVE-2024-7727 affects all versions of the HTML5 Video Player plugin up to and including 2.5.32.
What kind of data is at risk with CVE-2024-7727?
CVE-2024-7727 exposes the risk of unauthorized access to user data and media files.
What plugins are impacted by CVE-2024-7727?
CVE-2024-7727 impacts the HTML5 Video Player – mp4 Video Player Plugin for WordPress.