The HTML5 Video Player plugin for WordPress by bplugins suffers from a missing authorization (CWE-862) vulnerability affecting all versions up to 2.5.32. Specifically, multiple functions invoked via the 'h5vp_ajax_handler' AJAX action lack capability checks, enabling unauthenticated attackers to manipulate data by calling these functions directly. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact. No known exploits are reported in the wild. There is no vendor advisory or patch link currently available, so patch status is unknown.

The vulnerability allows unauthenticated attackers to manipulate data within the affected WordPress plugin due to missing authorization checks. This can compromise data integrity but does not affect confidentiality or availability. The medium CVSS score reflects the potential for unauthorized data manipulation without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the AJAX endpoint if possible or disabling the plugin if it is not essential. Monitor official bplugins communications for updates and apply any official patches promptly once released.