CVE-2024-7727: HTML5 Video Player Auth Bypass Vulnerability

CVE-2024-7727 Overview

CVE-2024-7727 affects the HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress. The plugin lacks a capability check on multiple functions invoked through the h5vp_ajax_handler AJAX action. Unauthenticated attackers can call these functions over the network to manipulate plugin data without any user interaction. The flaw is classified under CWE-862: Missing Authorization and impacts all plugin versions up to and including 2.5.32. The vendor bplugins addressed the issue in a subsequent release tracked in the WordPress plugin repository.

Critical Impact
Remote, unauthenticated attackers can invoke privileged AJAX handlers to modify plugin data on affected WordPress sites.

Affected Products

bplugins HTML5 Video Player plugin for WordPress, all versions through 2.5.32
WordPress sites running the html5-video-player plugin with the h5vp_ajax_handler action registered
Sites using the mp4 Video Player Block variant of the same plugin

Discovery Timeline

2024-09-11 - CVE-2024-7727 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7727

Vulnerability Analysis

The HTML5 Video Player plugin registers the h5vp_ajax_handler AJAX action to dispatch multiple internal operations. Each dispatched function performs data manipulation without verifying whether the caller holds the required WordPress capability. Because WordPress routes AJAX requests through admin-ajax.php regardless of authentication state, the missing check exposes these operations to any anonymous visitor. The impact is limited to integrity of plugin-managed data, with no direct confidentiality or availability loss.

Root Cause

The root cause is the absence of a current_user_can() check inside the handler and its downstream functions. The plugin's Ajax.php model dispatches actions and the ImportData.php model performs data mutations without validating the caller's privileges. Nonce verification alone, if present, does not restrict access when the nonce is exposed to unauthenticated visitors. The design assumes trusted callers but does not enforce that assumption.

Attack Vector

An attacker sends a crafted POST request to wp-admin/admin-ajax.php targeting action=h5vp_ajax_handler with parameters that select one of the vulnerable subfunctions. No credentials or user interaction are required. Successful requests trigger data manipulation, including import operations exposed by ImportData.php. Refer to the Wordfence Vulnerability Report and the WordPress HTML5 Video Player AJAX Code for the vulnerable dispatcher.

Detection Methods for CVE-2024-7727

Indicators of Compromise

Unexpected POST requests to admin-ajax.php containing action=h5vp_ajax_handler from unauthenticated sessions
Unexplained changes to HTML5 Video Player plugin data, imported configurations, or new video entries
Web server access logs showing repeated calls to h5vp_ajax_handler from a single IP or user agent

Detection Strategies

Review WordPress access logs for anonymous requests targeting h5vp_ajax_handler and correlate with session cookies
Inspect plugin database tables and options for entries created outside authorized administrator activity
Deploy a web application firewall rule that requires an authenticated administrator session for the h5vp_ajax_handler action

Monitoring Recommendations

Enable audit logging for WordPress plugin option changes and import events
Alert on burst patterns of admin-ajax.php requests referencing plugin-specific actions
Monitor for the plugin version string 2.5.32 or earlier across managed WordPress sites

How to Mitigate CVE-2024-7727

Immediate Actions Required

Update the HTML5 Video Player plugin to the version released after WordPress Changeset #3139559
Inventory all WordPress instances and identify those running html5-video-player at or below version 2.5.32
Restrict access to wp-admin/admin-ajax.php at the WAF or reverse proxy layer where feasible

Patch Information

The vendor bplugins committed the fix in WordPress Changeset #3139559. Site administrators should upgrade through the WordPress plugin management interface or via WP-CLI using wp plugin update html5-video-player. Verify the installed version exceeds 2.5.32 after the update completes.

Workarounds

Deactivate the HTML5 Video Player plugin until the patched version is deployed
Add a WAF rule blocking unauthenticated POST requests where the action parameter equals h5vp_ajax_handler
Remove or firewall admin-ajax.php exposure to untrusted networks on non-public administrative sites

bash

# Update the plugin using WP-CLI
wp plugin update html5-video-player
wp plugin get html5-video-player --field=version