CVE-2025-68505: WordPress H5P plugin <= 1.16.1 - Broken Access Control vulnerability
Published Dec 24, 2025
·Updated
Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.
Affected Software
2 affected components
icc0rz/h5p<=1.16.1
wordpress/h5p<=1.16.1
Event History
Dec 24, 2025
CVE Published
via MITRE·12:31 PM
Data Sourced
via MITRE·12:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Jan 12, 58291
Event
via MITRE·07:06 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-68505?
CVE-2025-68505 carries a medium severity rating due to its potential for unauthorized access.
2
How do I fix CVE-2025-68505?
To fix CVE-2025-68505, update the H5P plugin to a version later than 1.16.1.
3
What causes CVE-2025-68505?
CVE-2025-68505 is caused by missing authorization checks in the H5P plugin, leading to improperly configured access control.
4
What software is affected by CVE-2025-68505?
CVE-2025-68505 affects versions of the H5P plugin for both icc0rz and WordPress up to and including version 1.16.1.
5
Can CVE-2025-68505 lead to data breaches?
Yes, CVE-2025-68505 can potentially allow attackers to access sensitive data due to inadequate access controls.