CVE-2026-4357: Embed HTML5 Game WordPress Auth Bypass

CVE-2026-4357 Overview

CVE-2026-4357 affects the Embed HTML5 Game WordPress plugin through version 1.3. The plugin fails to restrict who can upload files and what file types are permitted. Unauthenticated attackers can upload PHP backdoors to affected WordPress sites. This flaw is classified as an Unrestricted Upload of File with Dangerous Type [CWE-434]. Successful exploitation yields full remote code execution on the underlying web server.

Critical Impact
Unauthenticated attackers can upload arbitrary PHP files, resulting in complete site compromise and remote code execution.

Affected Products

Embed HTML5 Game WordPress plugin, all versions through 1.3
WordPress installations with the plugin active
Sites hosting user-facing pages that invoke the plugin's upload handler

Discovery Timeline

2026-09-02 - CVE-2026-4357 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-4357

Vulnerability Analysis

The Embed HTML5 Game plugin exposes a file upload endpoint without authentication checks or file-type validation. Attackers submit HTTP POST requests containing PHP payloads directly to the plugin's upload handler. The server writes the uploaded file into a web-accessible directory using the attacker-controlled filename and extension. Once written, the attacker requests the file over HTTP to execute arbitrary PHP code in the context of the web server user.

The issue combines two failures. First, the plugin lacks capability checks such as current_user_can() before processing uploads. Second, it does not validate file extensions, MIME types, or magic bytes against an allowlist. Together these gaps convert a benign game-embedding feature into an unauthenticated remote code execution primitive.

Root Cause

The root cause is missing authorization and missing input validation on the plugin's upload handler. WordPress provides wp_check_filetype_and_ext() and nonce/capability APIs, but the plugin does not apply them. The handler accepts any file, including PHP scripts, and stores them under the site's uploads path.

Attack Vector

An attacker sends a crafted multipart HTTP POST request to the plugin's upload endpoint containing a PHP webshell. The server accepts the file, writes it to a public directory, and returns a predictable URL. The attacker then issues an HTTP GET request to the uploaded file to execute commands. No credentials, user interaction, or prior foothold are required.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-4357

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside wp-content/uploads/ or plugin-specific upload directories
POST requests to Embed HTML5 Game plugin upload endpoints from unauthenticated sources
Web server processes spawning shells such as sh, bash, or cmd.exe from the PHP worker
Outbound connections from the web server to unfamiliar IP addresses following upload activity

Detection Strategies

Scan the WordPress uploads directory for PHP files, which should not normally exist there
Review web server access logs for POST requests to plugin upload URIs returning HTTP 200 without authentication cookies
Alert on file integrity monitoring events showing new executable content written under wp-content/

Monitoring Recommendations

Enable web application firewall rules that block PHP file uploads to WordPress endpoints
Forward WordPress access and PHP-FPM logs to a centralized analytics platform for correlation
Monitor for post-exploitation behavior including reverse shells, cron modifications, and new administrative user creation

How to Mitigate CVE-2026-4357

Immediate Actions Required

Deactivate and remove the Embed HTML5 Game plugin from all WordPress installations until a fixed version is released
Audit wp-content/uploads/ and remove any unauthorized PHP files
Rotate WordPress administrator passwords, secret keys in wp-config.php, and database credentials if compromise is suspected
Review installed plugins, themes, and users for backdoors added after the exposure window

Patch Information

No vendor patch is referenced in the advisory at time of publication. Track the WPScan Vulnerability Report for updated fix availability and upgrade once a version above 1.3 that addresses the upload handler is released.

Workarounds

Block requests to the plugin's upload endpoint at the web application firewall or reverse proxy
Deny PHP execution inside wp-content/uploads/ using web server configuration directives
Restrict WordPress file writes by setting DISALLOW_FILE_MODS to true in wp-config.php where feasible

bash

# Apache: prevent PHP execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}