CVE-2026-4357: Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using the Embed HTML5 Game plugin version 1.3 or earlier are affected. The issue can be exploited remotely without authentication.
What does an attacker need to exploit the vulnerability?
An attacker does not need a WordPress account, elevated privileges, or user interaction. They can upload a PHP backdoor through the plugin because upload access and permitted file types are not properly restricted.
What is the likely impact of successful exploitation?
Successful exploitation can allow an attacker to place a PHP backdoor on the site. This can lead to compromise of confidentiality, integrity, and availability, including execution of attacker-controlled server-side code.