Is CVE-2026-57321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57321 being exploited in the wild.

How severe is CVE-2026-57321?

High severity, with a CVSS score of 7.1, published 26 June 2026.

Is there a fix for CVE-2026-57321?

A patch was published on 2026-06-26: Version 1.17.8 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57321 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57321?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57321: H5P WordPress plugin arbitrary file deletion via path traversal

CVE-2026-57321 · Severity: high · CVSS 7.1 · Published 2026-06-26

The H5P plugin for WordPress, which is used to create and share interactive web content, contains a security flaw that allows users with 'Contributor' level access to delete files on the server. An attacker could use this to delete critical website files, potentially causing the site to crash or stop functioning entirely. This could lead to significant downtime and operational disruption for organizations relying on the plugin for educational or interactive content.

Quick answers

Is CVE-2026-57321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57321 being exploited in the wild.
How severe is CVE-2026-57321?: High severity, with a CVSS score of 7.1, published 26 June 2026.
Which products and versions are affected?: icc0rz H5P <= 1.17.7.
Is there a fix for CVE-2026-57321?: A patch was published on 2026-06-26: Version 1.17.8 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57321 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57321?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An arbitrary file deletion vulnerability exists in the H5P WordPress plugin (versions <= 1.17.7) due to improper limitation of a pathname to a restricted directory (CWE-22). The flaw allows an authenticated attacker with 'Contributor' or higher privileges to perform path traversal and delete arbitrary files on the server. This is achieved by manipulating file paths in requests handled by the plugin. Successful exploitation can lead to a denial-of-service condition by deleting critical system or application files. The issue is resolved in version 1.17.8.

Affected products

icc0rz H5P <= 1.17.7

Timeline

2026-05-10: disclosed: Reported by researcher daroo via Patchstack
2026-06-26: advisory: CVE-2026-57321 published
2026-06-26: patched: Version 1.17.8 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.