EUVD-2026-107427
GHSA-vc4c-mh3j-3h84
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryIdentify object-key parameter
-
ExploitSubstitute another user's identifier
-
ExecutionBypass access control
-
ImpactModify unauthorized resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account on a site running the H5P plugin version 1.17.9 or earlier (PR:L), reflecting the advisory's note of 'incorrectly configured access control security levels.' The attacker must be able to supply or alter the user-controlled object key in a request to an H5P endpoint. Limiting factors: valid (even if low-privilege) authentication is mandatory, so fully anonymous exploitation is not possible; impact is confined to integrity (no data disclosure or denial of service per the vector); and the site must have the vulnerable plugin installed and active. |
| Impact | This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) attack with no user interaction, low complexity, and limited impact confined to integrity (I:L) with no confidentiality or availability impact. The CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) classification is consistent with this: a logged-in low-privilege user manipulates an object identifier to reach resources they should not. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals to reconcile - rather, key prioritization signals (EPSS, KEV, SSVC) are simply absent, which itself argues against treating this as an urgent item. The requirement for valid authentication (PR:L) and the integrity-only, limited impact meaningfully cap real-world risk despite the network attack vector. |
| Exploit ScenarioDerived | An authenticated low-privilege WordPress user (e.g., a subscriber or contributor) sends a request to an H5P plugin endpoint while substituting another user's or object's identifier in a user-controlled key parameter, causing the plugin to act on a resource outside the attacker's authorization scope. Because attack complexity is low and no user interaction is needed, the request can be issued directly once a foothold account exists. No public exploit code or active exploitation has been identified for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authorization bypass in the H5P WordPress plugin (versions through 1.17.9) lets an authenticated user manipulate a user-controlled object key to defeat the plugin's access-control checks and modify H5P content they are not authorized to change. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability effect, and low-privilege authentication is a hard prerequisite, so this is a moderate, not high-priority, issue. No public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
RemediationAI
The provided data does not identify a fixed version - the advisory lists versions through 1.17.9 as vulnerable without naming a patched release, so the status is best described as no vendor-released patch identified at time of analysis; confirm the current fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve) or the H5P WordPress plugin repository and upgrade as soon as a patched release is published. Until then, apply compensating controls matched to the PR:L prerequisite: remove H5P-related capabilities (for example h5p_content creation/editing) from subscriber, contributor, and other untrusted roles so only trusted editors can reach the vulnerable endpoints - accepting that legitimate low-privilege authoring workflows will break; restrict access to H5P admin-ajax and REST routes by role or source IP at the web server or WAF, with the trade-off that overly broad rules block legitimate authors and generate false positives; deploy a virtual patch that validates that the requesting user owns or is authorized for the supplied object key - this requires per-request logic and may add latency; and if H5P interactive content is not in active use, deactivate and remove the plugin entirely, at the cost of losing the associated content and any embedded shortcodes rendering. Review existing H5P content for unexpected modifications as a detection measure, since the integrity-only impact means tampering may otherwise go unnoticed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is the H5P plugin for WordPress (CPE cpe:2.3:a:h5p:h5p:*:*:*:*:*:*:*:*), which adds interactive content types (quizzes, presentations, interactive videos) and exposes endpoints for creating, editing, and fetching H5P content objects. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key - a classic insecure direct object reference where the plugin trusts a client-supplied object identifier and performs an insufficient capability/ownership check on it. WordPress delegates authorization to its roles-and-capabilities model, so the defect amounts to an incorrectly configured or missing access-control check on an H5P endpoint rather than a memory-safety or injection flaw. Because the CVSS vector is PR:L with AV:N/AC:L, the flaw is remotely reachable but requires a valid, even low-privilege, WordPress session; per the vector there is no scope change and no confidentiality or availability impact, only unauthorized modification of content.
Know when H5P gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Remotely reachable HTTP endpoint (AV:N/AC:L) but requires a valid low-privilege account (PR:L); IDOR enables limited unauthorized modification (I:L) with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and ab
Reflected cross-site scripting in the H5P WordPress plugin (versions 1.17.6 and earlier) lets an unauthenticated attacke
Exploit-DB