Articulate archive validation permits executable uploads
Insert or Embed Articulate Content into WordPress through 4.3000000027 relies on a bypassable validation check for uploaded archive contents. An Editor-level user can place a server-executable file from a crafted archive into a public directory and execute it on servers configured to run that file type. The CNA record does not disclose the upload route, archive structure, validation function, destination path or bypass encoding.
- Component
- Insert or Embed Articulate Content into WordPress
- Plugin slug
insert-or-embed-articulate-content-into- Affected
- <= 4.3000000027
- Safe version
> 4.3000000027- Published
- Aug 03, 2026
This CVE was published Aug 03, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update to a corrected release after 4.3000000027 when available. Until then, restrict Articulate uploads to trusted administrators, prevent script execution in upload directories, remove unexpected executable files and investigate Editor upload activity.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H