CVE-2026-4357

Published: Sep 2, 2026Modified: Sep 3, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: contact@wpscan.com (Secondary)

Description

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (1)

https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

Source: contact@wpscan.com

Timeline

No history available yet.