CVE-2024-7721
📋 TL;DR
This vulnerability in the HTML5 Video Player WordPress plugin allows authenticated attackers with Subscriber-level access or higher to modify plugin settings without proper authorization. Attackers can enable user registration even if it was disabled, potentially allowing unauthorized account creation. All WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- HTML5 Video Player – mp4 Video Player Plugin and Block for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers enable user registration, create admin accounts, and gain full control of the WordPress site, potentially leading to data theft, defacement, or malware installation.
Likely Case
Attackers enable user registration to create additional accounts for spam, credential harvesting, or maintaining persistent access to the compromised site.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized plugin setting changes that can be detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.35
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3148088/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'HTML5 Video Player'. 4. Click 'Update Now' if available, or download version 2.5.35+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the HTML5 Video Player plugin until patched
wp plugin deactivate html5-video-player
Restrict user registration
allEnsure user registration is disabled in WordPress settings
wp option update users_can_register 0
🧯 If You Can't Patch
- Remove Subscriber and higher role access from untrusted users
- Implement web application firewall rules to block suspicious AJAX requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → HTML5 Video Player version. If version is 2.5.34 or lower, you are vulnerable.Check Version:
wp plugin get html5-video-player --field=versionVerify Fix Applied:
Verify plugin version is 2.5.35 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with action 'save_password'
- Sudden increase in user registrations
- Changes to plugin settings from non-admin users
Network Indicators:
- POST requests to admin-ajax.php with save_password parameter from non-admin IPs
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "save_password" AND NOT user_role="administrator"