Remote Code Injection in Articulate Content Plugin for WordPress
CVE-2026-16060
Currently unrated
What is CVE-2026-16060?
The Insert or Embed Articulate Content plugin for WordPress, up to version 4.3000000027, has a critical vulnerability that allows Editor-level users to exploit the feature for uploading archives. The plugin fails to adequately validate the contents of these uploads, enabling the upload of executable files to public directories. This could result in unauthorized remote code execution on servers configured to process such files, exposing them to malicious attacks and security breaches.
Affected Version(s)
Insert or Embed Articulate Content into WordPress 0 <= 4.3000000027
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.