Atomic Edge analysis of CVE-2026-57321:
This vulnerability allows authenticated attackers with Contributor-level access to delete arbitrary files on the WordPress server. The flaw exists in the Interactive Content – H5P plugin versions up to and including 1.17.7. The CVSS score is 8.1, indicating high severity.
The root cause resides in insufficient file path validation within the H5P editor library. Specifically, the vulnerable code is in `/h5p/h5p-editor-php-library/h5peditor.class.php` at lines 176-177. The original check uses `preg_match(‘/^(w+://|../)/i’, $oldFiles[$i]) === 0` to block only files with protocol prefixes or directory traversal sequences. This regex does not catch files containing `./` (current directory references) or `//` (double slash). An attacker can supply a path like `./wp-config.php` which passes the old validation. The function `removeContentFile` then deletes the file without sufficient sanitization. Additionally, the `cloneContentFile` method in `/h5p/h5p-php-library/h5p-default-storage.class.php` at line 334 also lacked similar validation.
Exploitation requires Contributor-level access or higher. The attacker interacts with the H5P content editor, likely via AJAX endpoints that trigger the file cleanup routine. By sending a crafted request to the H5P content update or creation action, the attacker sets `oldFiles` parameters containing malicious file paths. The vulnerable loop iterates over old files and deletes those not present in the new file list. The attacker supplies a path like `./wp-config.php` which bypasses the original regex, causing the plugin to delete the target file. The exact AJAX action is likely `h5p_update_content` or similar, but the core issue is the path validation bypass.
The patch changes the path validation in `h5peditor.class.php` from a regex to explicit checks using `str_contains` for `./` and `//`. The new condition is `!str_contains($oldFiles[$i], ‘./’) && !str_contains($oldFiles[$i], ‘//’)`. This blocks any file path containing a current directory reference or double slashes. A similar fix was applied to `cloneContentFile` in `h5p-default-storage.class.php` with a guard that returns early if `str_contains($file, ‘./’)`. These changes prevent attackers from using relative or malformed paths to escape the intended content directory.
The impact is severe: authenticated attackers can delete critical files such as `wp-config.php`, which contains database credentials and security keys. Deleting this file can allow remote code execution if the WordPress installation attempts to regenerate the config file or if the site becomes misconfigured. Arbitrary file deletion can also remove `.htaccess`, `index.php`, or plugin/theme files, leading to site defacement, denial of service, or further exploitation.
