Insert Or Embed Articulate Content Into Wordpress
Monthly
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.