What is GHSA-j479-42pv-8r66?

GHSA-j479-42pv-8r66 is a security advisory published by GitHub Security Advisories with Critical severity. The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files...

Which CVE IDs does GHSA-j479-42pv-8r66 cover?

GHSA-j479-42pv-8r66 covers the following CVE IDs: CVE-2026-4357. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j479-42pv-8r66?

GHSA-j479-42pv-8r66 has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-j479-42pv-8r66CriticalCVSS 10.0

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-4357 →

📋 Description

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-4357
https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698
https://github.com/advisories/GHSA-j479-42pv-8r66