CVE-2026-4357: CWE-434 Unrestricted Upload of File with Dangerous Type in Embed HTML5 Game

The Embed HTML5 Game WordPress plugin up to version 1.3 does not properly restrict file upload permissions or validate file types, allowing unauthenticated attackers to upload malicious PHP files. This unrestricted upload vulnerability (CWE-434) can be exploited to deploy backdoors on affected sites, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 10.0, indicating a critical severity with network attack vector, no privileges required, no user interaction, and scope change.

Successful exploitation allows remote unauthenticated attackers to upload and execute arbitrary PHP code on the affected WordPress site, leading to full compromise including data theft, site defacement, or further attacks on the hosting environment. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's upload functionality, disable or remove the plugin if not needed, and monitor for suspicious file uploads. Avoid exposing the plugin to untrusted users.