Executive brief
The H5P plugin for WordPress, which is used to create and share interactive web content, contains a security flaw that allows users with 'Contributor' level access to delete files on the server. An attacker could use this to delete critical website files, potentially causing the site to crash or stop functioning entirely. This could lead to significant downtime and operational disruption for organizations relying on the plugin for educational or interactive content.
Technical details
An arbitrary file deletion vulnerability exists in the H5P WordPress plugin (versions <= 1.17.7) due to improper limitation of a pathname to a restricted directory (CWE-22). The flaw allows an authenticated attacker with 'Contributor' or higher privileges to perform path traversal and delete arbitrary files on the server. This is achieved by manipulating file paths in requests handled by the plugin. Successful exploitation can lead to a denial-of-service condition by deleting critical system or application files. The issue is resolved in version 1.17.8.
Affected products
- icc0rz H5P <= 1.17.7
Timeline
- 2026-05-10: disclosed: Reported by researcher daroo via Patchstack
- 2026-06-26: advisory: CVE-2026-57321 published
- 2026-06-26: patched: Version 1.17.8 released to address the vulnerability