The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
Metrics
Affected Vendors & Products
References
History
Wed, 18 Sep 2024 18:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Bplugins
Bplugins html5 Video Player |
|
CPEs | cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Bplugins
Bplugins html5 Video Player |
Wed, 11 Sep 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 11 Sep 2024 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data. | |
Title | HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler | |
Weaknesses | CWE-862 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-11T04:31:20.937Z
Updated: 2024-09-11T18:12:22.682Z
Reserved: 2024-08-12T22:09:56.793Z
Link: CVE-2024-7727
Vulnrichment
Updated: 2024-09-11T18:12:17.138Z
NVD
Status : Analyzed
Published: 2024-09-11T05:15:03.400
Modified: 2024-09-18T18:07:55.450
Link: CVE-2024-7727
Redhat
No data.