The Insert or Embed Articulate Content plugin for WordPress fails to properly validate the contents of an uploaded archive, using a check that can be bypassed by users with the Editor role. An Editor can upload an arbitrary file that is placed into a publicly accessible directory; if the server is configured to execute that file, the attacker can run code on the host. This is an arbitrary file upload vulnerability that directly leads to remote code execution.

WordPress sites running the Insert or Embed Articulate Content plugin version 4.3000000027 or earlier are affected. The vulnerability applies to all installations of the plugin where an Editor is granted access, regardless of the overall WordPress version.

Because the flaw allows remote code execution, the risk is high, and the EPSS score is 0.00206, and the vulnerability is not listed in CISA’s KEV catalog. The attacker only needs an Editor role, which is a common user level on many sites, and can exploit the plugin’s file upload interface to place a server‑executable script in a public location. Successful exploitation depends on the server being configured to interpret scripts in that directory, but the conditions are often met on typical WordPress hosting environments. The CVSS score is 9.8, indicating a critical severity.