CVE-2024-7727

CVSS V2 None CVSS V3 None

Description

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.

Overview

CVE ID
CVE-2024-7727

Assigner
Wordfence

Vulnerability Status
PUBLISHED

Published Version
2024-09-11T04:31:20.937Z

Last Modified Date
2024-09-11T04:31:20.937Z

Weakness Enumerations

CWE	URL
CWE-862	http://cwe.mitre.org/data/definitions/862.html

References

Reference URL	Reference Tags
https://www.wordfence.com/threat-intel/vulnerabilities/id/908df18e-7178-4d40-becb-86e1a714a7da?source=cve
https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/ImportData.php#L4
https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L5
https://plugins.trac.wordpress.org/changeset/3139559/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-7727
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7727

History

Created	Old Value	New Value	Data Type	Notes
2024-09-11 13:09:28				Added to TrackCVE