# CVE-2026-4357: WordPress Embed HTML5 Game plugin unauthenticated file upload

Source: https://junglewise.ai/threats/cve-2026-4357-wordpress-embed-html5-game-plugin-unauthenticated-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-4357 · Severity: critical · CVSS 10 · Published 2026-09-02

The Embed HTML5 Game WordPress plugin allows unauthenticated users to upload files without proper validation, enabling attackers to deploy malicious PHP code on vulnerable websites. This vulnerability allows remote attackers to gain unauthorized access and control over affected WordPress installations without requiring valid credentials or user interaction.

Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-4357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4357 being exploited in the wild.

**How severe is CVE-2026-4357?** Critical severity, with a CVSS score of 10, published 2 September 2026.

**Which products and versions are affected?** Wordpress Embed HTML5 Game through 1.3.

**Is there a fix for CVE-2026-4357?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4357 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-4357?** Check whether you run Wordpress Embed HTML5 Game at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to implement proper authentication and file type validation on its upload functionality. Unauthenticated attackers can exploit the upload mechanism to submit arbitrary files, including PHP backdoors, which can then be executed on the server. The vulnerability requires only network access to the affected WordPress site and no authentication credentials. Successful exploitation grants an attacker remote code execution capabilities, allowing complete compromise of the website. No known patch is currently available for affected versions through 1.3.

## Affected products

- WordPress Embed HTML5 Game through 1.3

## Timeline

- 2026-04-21: disclosed
- 2026-09-02: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/](https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/)