The H5P WordPress plugin contains an Authorization Bypass Through User-Controlled Key flaw that allows an attacker to manipulate object identifiers and bypass the intended access control checks. This leads to an Insecure Direct Object Reference (IDOR) condition, enabling unauthorized viewing or modification of H5P content. The weakness is classified as CWE‑639, exposing confidentiality and integrity vulnerabilities if exploited.

Affected are WordPress sites that use the H5P plugin version 1.17.9 or earlier. The vendor is H5P; the product is the WordPress H5P plugin. All releases from the initial version up to and including 1.17.9 are potentially vulnerable.

The CVSS score of 4.3 indicates moderate severity, and no EPSS score is published, meaning the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers likely need to know or guess an object identifier—possibly as an authenticated user with limited permissions. If successfully exploited, the attacker could read or edit protected content, compromising data confidentiality and integrity across affected sites.