EUVD-2026-39733
GHSA-6pq6-5jrw-hgmm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Authenticated Contributor reachable over the network (AV:N, PR:L); file deletion yields high availability and partial integrity impact but no data disclosure (C:N, I:L, A:H).
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
1DescriptionCVE.org
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
AnalysisAI
Arbitrary file deletion in the H5P WordPress plugin (versions 1.17.7 and earlier) lets a low-privileged authenticated user with Contributor-level access delete arbitrary files on the server via path traversal. The CVSS:3.1 vector (AV:N/PR:L) confirms remote, low-privilege exploitation with high availability impact, and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated WordPress account with at least Contributor-level privileges (matching CVSS PR:L) on a site running the H5P plugin at version 1.17.7 or earlier; the attacker uses an H5P content/library file operation to supply a traversal path that escapes the H5P content directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and broadly consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a Contributor account on a multi-author WordPress site running H5P <= 1.17.7, then issues a crafted H5P content request containing path-traversal sequences that point at a sensitive file such as wp-config.php. The plugin deletes the targeted file, causing site outage or, where WordPress then enters setup mode, enabling a follow-on takeover. … |
| Remediation | Upgrade the H5P plugin to the first release published after 1.17.7 that addresses this issue; a released patched version is not independently confirmed in the provided data, so verify the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-7-arbitrary-file-deletion-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all WordPress installations running H5P plugin v1.17.7 or earlier; identify users with Contributor role or equivalent capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today