The bplugins HTML5 Video Player WordPress plugin suffers from a missing capability check in its 'save_password' function, which is responsible for saving certain plugin options. Because of this missing authorization, any authenticated user with at least Subscriber privileges can modify plugin settings that are not explicitly protected, potentially altering configurations like enabling user registration. This vulnerability is tracked as CVE-2024-7721 and is classified under CWE-862 (Missing Authorization). It affects all versions up to 2.5.34 and has a CVSS v3.1 base score of 4.3, indicating medium severity. There is no vendor advisory or patch link available at this time.

An attacker with authenticated access at the Subscriber level or above can exploit this vulnerability to modify plugin options without proper authorization. This unauthorized modification can include enabling user registration if it was disabled, potentially increasing the attack surface of the WordPress site. The vulnerability does not directly impact confidentiality or availability but allows integrity modification of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict Subscriber-level access carefully and monitor for unauthorized changes to plugin settings. Consider disabling or removing the affected plugin if feasible to reduce risk.