Answer in brief
CVE-2026-16060 records a Critical severity (CVSS 9.8) vulnerability in Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload. The current sources do not mark it as known exploited. The current feed maps Unknown/Insert or Embed Articulate Content into WordPress (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Insert or Embed Articulate Content into WordPress (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Insert or Embed Articulate Content into WordPressgeneric | 0 | Not reported |
Published upstream
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-16060 records a Critical severity (CVSS 9.8) vulnerability in Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload. The current sources do not mark it as known exploited. The current feed maps Unknown/Insert or Embed Articulate Content into WordPress (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Insert or Embed Articulate Content into WordPress (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Insert or Embed Articulate Content into WordPressgeneric | 0 | Not reported |
Published upstream
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
Quoted source text, attributed separately from HOL analysis.