Description

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-02T15:17:38.413Z",
  "pubdate": "2026-09-02T15:17:38.413Z",
  "executiveSummary": "The Embed HTML5 Game WordPress plugin through version 1.3 contains a critical security vulnerability involving improper access control and insufficient file validation mechanisms.\nThis vulnerability allows unauthenticated remote attackers to upload arbitrary files, including malicious PHP scripts, directly to the web server.\nThe core of the issue lies in the plugin's failure to enforce authentication checks or sanitize file extensions during the upload process.\nSuccessful exploitation results in Unrestricted File Upload, leading to Remote Code Execution (RCE).\nAn attacker can gain full control over the compromised WordPress installation, potentially accessing sensitive database information, modifying site content, or using the server as a pivot point for further network infiltration.\nDue to the lack of required authentication or privilege levels, the risk profile is categorized as critical, as the vulnerability is accessible to any remote user capable of reaching the target's web interface.",
  "technicalDetails": "The Embed HTML5 Game plugin, in versions up to and including 1.3, implements a file upload functionality that lacks sufficient security controls, specifically failing to validate the identity of the requester and the integrity of the uploaded file's content or extension.\nThe vulnerability originates from the plugin's request handling logic, which processes incoming HTTP POST requests directed at the file upload endpoint without verifying the session's authentication status. By design, the plugin should restrict such administrative functions to authorized users with appropriate capabilities; however, the absence of capability checks or nonce verification permits unauthorized access.\nThe exploitation flow proceeds as follows: An unauthenticated attacker identifies the public-facing endpoint used by the plugin to process game file uploads. The attacker crafts a multipart/form-data request containing a malicious payload, typically a PHP web shell (e.g., a file with a .php extension or a double-extension variant). Because the plugin does not enforce a whitelist of permitted file extensions or validate the MIME type against the actual file content, the server accepts the malicious file.\nOnce the file is successfully uploaded to the web directory, the attacker can execute arbitrary code by directly accessing the file's URL path through a standard HTTP GET request. Upon execution, the payload operates within the context of the web server process, inheriting its permissions.\nPost-exploitation, the attacker maintains persistent access to the server, allowing for the exfiltration of the wp-config.php file—containing database credentials—or the deployment of secondary payloads such as backdoors, ransomware, or spam distribution scripts. Furthermore, since the uploaded files are stored within the web-accessible directory, the vulnerability effectively bypasses traditional perimeter defenses that are not configured to inspect the contents of legitimate plugin-handled uploads.\nThis vulnerability highlights a critical failure in input sanitization and access control, specifically regarding the lack of server-side verification of file types and the absence of authorization checks on functionality that facilitates server-side code storage and execution."
}