CVE-2026-4357

critical · 10

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

CVSS

0.5%

EPSS (exploit prob.)

45th

EPSS percentile

2026-09-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-434

References

https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-4357