CVE-2024-7721 Missing authorization in HTML5 Video Player – Embed and Play Videos in Custom Player

Medium 4.3 Published 11 Sep 2024 Updated 8 Apr 2026

Authenticated subscribers can modify plugin settings, including enabling user registration, due to missing capability checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-7721?

CVE-2024-7721 is a medium-severity missing authorization vulnerability in bplugins HTML5 Video Player – Embed and Play Videos in Custom Player, published on 11 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.

Weakness: CWE-862

Which versions are affected by CVE-2024-7721?

It affects 1 product.

Products include Bplugins Html5 Video Player.

How do I fix CVE-2024-7721?

No fix has been published for CVE-2024-7721 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-7721 being exploited?

There is no known exploitation of CVE-2024-7721 in the wild and no public exploit code.

Sources

Also known as GHSA-6m95-wprq-2gv6.