CVE-2026-4357

10.0 Critique

Publiée le 02/09/2026 à 17:17 · Modifiée le 03/09/2026 à 19:50 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Traduire en français

Produits concernés

Unknown Embed HTML5 Game

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-434

Références

https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories