A critical unauthenticated file upload vulnerability in the Embed HTML5 Game WordPress plugin allows attackers to execute arbitrary code, posing a severe risk of total system compromise.

This vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434), where the plugin fails to perform necessary authentication or file type validation, allowing unauthenticated attackers to upload malicious scripts directly to the server.

The ability for an unauthenticated attacker to upload and execute arbitrary PHP code results in a full compromise of the web server. This level of access grants the attacker the power to exfiltrate sensitive data, modify website content, or use the server as a pivot point for further attacks on the internal network, justifying its critical CVSS score of 10.0.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and remove the Embed HTML5 Game plugin from all WordPress installations until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual POST requests targeting plugin directories and monitor for the creation of new, unexpected files in the upload folders.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block unauthorized file uploads and restrict access to common plugin upload endpoints to known administrative IP addresses.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability and the ease with which it can be exploited by unauthenticated actors, immediate action is required. Organizations should prioritize the removal of the vulnerable component and implement strict file upload policies to prevent further risk to the production environment.