What is the CVSS score of CVE-2026-16060?

CVE-2026-16060 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Insert or Embed Articulate Content are affected by CVE-2026-16060?

The WordPress Articulate Content plugin (versions ≤4.3000000027) contains a critical remote code execution vulnerability exploitable by Editor-level users, with no vendor patch currently available.

Is there a public PoC exploit available for CVE-2026-16060?

Yes, a public proof-of-concept exploit is available for CVE-2026-16060. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16060?

Within 24 hours, identify all WordPress installations using Articulate Content plugin versions up to 4.3000000027; disable the plugin on all instances if feasible or isolate them from production traffic. Within 7 days, audit Editor-level WordPress user accounts for necessity and revoke where possible; implement web server-level file upload restrictions and disable PHP execution in the plugin upload directory (e.g., add php_flag engine off in .htaccess for Apache, or location block for nginx). Within 30 days, monitor the Articulate plugin repository for a patched version; establish a deployment plan to test and apply the update immediately when released.

Insert or Embed Articulate Content CVE-2026-16060

EUVD-2026-52177 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-03 WPScan

GHSA-v4q5-7cp7-m46j

WordPress RCE File Upload Insert Or Embed Articulate Content Into Wordpress Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Requires an authenticated Editor account so PR:L (not PR:N); remote low-complexity upload yields full code execution and total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 19:25 vuln.today

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.

AnalysisAI

Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.

Technical ContextAI

The plugin embeds Articulate e-learning packages (SCORM/Storyline archives) into WordPress by accepting an uploaded ZIP archive and extracting its contents into a web-accessible uploads directory. The vulnerability is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the plugin's validation of archive contents is bypassable, so a crafted archive can smuggle a server-executable file (e.g., a PHP script) past the check and land it in a directory the web server will execute. The single CPE, cpe:2.3:a:unknown:insert_or_embed_articulate_content_into_wordpress, confirms the affected component is the plugin itself rather than WordPress core, and successful execution depends on the host being configured to execute scripts (e.g., PHP) from the uploads path where the file is written.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to upgrade to any release later than 4.3000000027 once published by the vendor and to monitor the WPScan advisory (https://wpscan.com/vulnerability/a5937e0d-c1bc-4787-9ab9-ab58b9789b68/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16060) for a fixed build. In the interim, deactivate and remove the plugin if the Articulate-embedding feature is not essential, since that fully eliminates the upload path. If it must stay active, restrict who holds Editor-level roles and audit existing Editor accounts, and configure the web server to refuse execution of scripts within the WordPress uploads directory (for example, deny PHP execution via .htaccess, an nginx location block, or php_admin_flag engine off for that path) - this neutralizes the RCE even if a malicious file is written, at the cost of breaking any legitimate feature that relies on executing content from uploads. A WAF rule inspecting uploaded archive contents can add coverage but should be treated as a stopgap, not a fix.