Is CVE-2026-112868 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112868 being exploited in the wild.

How severe is CVE-2026-112868?

Medium severity, with a CVSS score of 4.3, published 21 October 2026.

Which products and versions are affected?

H5P WordPress plugin through 1.17.9.

Is there a fix for CVE-2026-112868?

Yes: fixed in 1.17.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112868 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112868?

Check whether you run H5P WordPress plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112868: H5P WordPress plugin authorization bypass in access control

CVE-2026-112868 · Severity: medium · CVSS 4.3 · Published 2026-10-21

The H5P WordPress plugin is used to create interactive educational content on websites. An authorization bypass vulnerability allows attackers with contributor-level access to view or manipulate other users' content by changing object identifiers in requests, potentially exposing sensitive educational data or course materials.

Vendors: H5P.

Quick answers

Is CVE-2026-112868 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112868 being exploited in the wild.
How severe is CVE-2026-112868?: Medium severity, with a CVSS score of 4.3, published 21 October 2026.
Which products and versions are affected?: H5P WordPress plugin through 1.17.9.
Is there a fix for CVE-2026-112868?: Yes: fixed in 1.17.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112868 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112868?: Check whether you run H5P WordPress plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.17.10

Technical details

An Insecure Direct Object References (IDOR) vulnerability in the H5P WordPress plugin fails to properly validate access control on API endpoints, allowing authenticated contributors to bypass authorization checks by modifying object IDs in requests. An attacker with contributor privileges can enumerate and access H5P content belonging to other users. A patch is available in version 1.17.10.

Affected products

H5P H5P WordPress plugin through 1.17.9

Timeline

2026-09-08: disclosed: Reported to Patchstack
2026-10-21: advisory: Published by Patchstack and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.