CVE-2026-57321

Deferred Deferred - Pending Action

Arbitrary File Deletion in H5P <= 1.17.7

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: Patchstack

Description

Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-06-29

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-15

NVD

CVE-2026-57321

EUVD

EUVD-2026-39733

Affected Vendors & Products

Vendor	Product	Version / Range
h5p	h5p	to 1.17.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-57321 is an Arbitrary File Deletion vulnerability found in the WordPress H5P Plugin versions 1.17.7 and earlier.

This flaw allows attackers to delete files from a website by exploiting broken access control mechanisms within the plugin.

If exploited, it can cause the website to malfunction or break, especially if critical files are removed.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Impact Analysis

An attacker exploiting this vulnerability can delete files on your website, which may lead to site malfunction or complete breakdown.

This can disrupt your website's availability and functionality, potentially causing downtime and loss of service.

Since the vulnerability is expected to be targeted in mass-exploit campaigns, websites of all sizes and popularity are at risk.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should immediately update the WordPress H5P Plugin to version 1.17.8 or later, which contains the patch for this arbitrary file deletion issue.

Until you can update, you may apply the mitigation rule provided by Patchstack to block attacks exploiting this vulnerability.

If you need assistance, contact your hosting provider or developer to help with the update and mitigation.

Hi! I’m here to help you understand CVE-2026-57321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70