What is the CVSS score of CVE-2026-57321?

CVE-2026-57321 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of H5P (WordPress plugin) are affected by CVE-2026-57321?

Organizations running WordPress with H5P plugin versions 1.17.7 or earlier face site availability and integrity risk; standard Contributor-level users can delete critical server files including…

How to fix or mitigate CVE-2026-57321?

24 hours: Inventory all WordPress installations running H5P plugin v1.17.7 or earlier; identify users with Contributor role or equivalent capabilities. 7 days: Disable H5P plugin on all affected instances and implement temporary alternative for H5P content delivery, or restrict Contributor role capabilities (remove plugin access via role management); apply file permission restrictions to critical files (wp-config.php: 644). 30 days: Evaluate and migrate to maintained plugin alternatives; if H5P must remain enabled, require patch deployment immediately upon vendor release.

H5P (WordPress plugin) CVE-2026-57321

EUVD-2026-39733 HIGH

Path Traversal (CWE-22)

2026-06-26 audit@patchstack.com

GHSA-6pq6-5jrw-hgmm

WordPress Path Traversal Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Authenticated Contributor reachable over the network (AV:N, PR:L); file deletion yields high availability and partial integrity impact but no data disclosure (C:N, I:L, A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:52 vuln.today

DescriptionCVE.org

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

AnalysisAI

Arbitrary file deletion in the H5P WordPress plugin (versions 1.17.7 and earlier) lets a low-privileged authenticated user with Contributor-level access delete arbitrary files on the server via path traversal. The CVSS:3.1 vector (AV:N/PR:L) confirms remote, low-privilege exploitation with high availability impact, and no public exploit has been identified at time of analysis. Deleting critical files such as wp-config.php can break the site or, in some setups, enable a reinstallation-based takeover.

Technical ContextAI

H5P is a popular WordPress plugin that lets authors embed interactive HTML5 content (quizzes, presentations, interactive video) inside posts and pages. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): a file path supplied during an H5P content/library file operation is not properly sanitized, so traversal sequences (e.g. ../../) escape the intended H5P upload/content directory and reference files elsewhere on the filesystem. Because H5P deliberately grants content-authoring capabilities to lower roles such as Contributor, an account that should only manage interactive content gains the ability to invoke a file-deletion code path against attacker-chosen paths. No specific CPE string was provided in the source data; affected scope is defined by the vendor description as H5P <= 1.17.7.

RemediationAI

Upgrade the H5P plugin to the first release published after 1.17.7 that addresses this issue; a released patched version is not independently confirmed in the provided data, so verify the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-7-arbitrary-file-deletion-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog before deploying. Until a confirmed patch is applied, reduce exposure by restricting who holds Contributor and higher roles: audit and remove untrusted contributor accounts, and disable open user registration or downgrade self-registered users to Subscriber (trade-off: legitimate contributors lose authoring ability). As a compensating control, enforce least-privilege filesystem permissions so the web server user cannot delete core files like wp-config.php or other application files outside the uploads directory (trade-off: may interfere with plugins that legitimately write outside uploads), and deploy a WAF or virtual patch (Patchstack offers one) to block path-traversal payloads in H5P requests. Maintain offline backups so any deletion can be recovered.