CVE-2026-4357 PUBLISHED

Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

Assigner: WPScan
Reserved: 17.03.2026 Published: 02.09.2026 Updated: 02.09.2026

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor Unknown
Product Embed HTML5 Game
Versions Default: unknown
  • affected from 0 to 1.3 (incl.)

Credits

  • Mike Gozdiskowski finder
  • WPScan coordinator

References

Problem Types

  • CWE-434 Unrestricted Upload of File with Dangerous Type CWE