CVE-2026-112868: WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress H5P pluginto a version that resolves this vulnerability.Fixed in 1.17.10
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires network access and low-privileged access to the affected WordPress H5P plugin. No user interaction is required.
What is the likely impact of successful exploitation?
The available severity vector indicates an integrity impact only, with no reported confidentiality or availability impact. The issue is described as an authorization bypass through a user-controlled key.
Which versions are affected?
H5P for WordPress versions through 1.17.9 are affected. The provided data does not identify a fixed version.