VulnSocial

CVE-2026-4357General

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-09-04: 1Patch / Workaround · 2026-09-04: 1Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 109-0309-04
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-031
General1
2026-09-041
Patch1
Full discourse2 posts
  • TheKnight7G@WH173H47
    General

    The Embed HTML5 Game plugin for WordPress (v1.3) lacks proper file upload restrictions. This opens doors for unauthorized file uploads, which could compromise sites. https://nvd.nist.gov/vuln/detail/CVE-2026-4357

    Post summary

    The statement notes that the WordPress Embed HTML5 Game plugin (v1.3) has inadequate file upload restrictions, allowing potential unauthorized uploads, but it provides no PoC, exploit, patch, or evidence of active use.

    0001034
    30 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🎮 Embed HTML5 Game WordPress plugin (≤1.3) allows unauthenticated arbitrary file upload — CVSS 10. No login needed to drop malicious files. CVE-2026-4357 — update or remove now. #cybersecurity #WordPress #vulnerabilities #ciso #mssp https://secalerts.co/vulnerability/CVE-2026-4357?utm_campaign=x https://t.co/yR8V2L0wAC

    Post summary

    The tweet warns of a CVSS 10 unauthenticated arbitrary file upload vulnerability (CVE‑2026‑4357) in the Embed HTML5 Game WordPress plugin, urging users to update or remove the plugin immediately.

    00000150
    888 followersView on X

Explore more

Back to dashboard