This vulnerability in the Insert or Embed Articulate Content into WordPress plugin arises from insufficient validation of uploaded archive contents. An attacker with Editor-level privileges can exploit this by uploading a malicious executable file to a public directory. If the server is configured to execute files in that directory, this can result in remote code execution, compromising the server.

An attacker with Editor-level access can upload executable files to the server, which may lead to remote code execution if the server executes files in the upload directory. This could allow the attacker to run arbitrary code on the affected server, potentially leading to full system compromise depending on server configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level user permissions and avoid allowing uploads of executable files. Review server configurations to prevent execution of uploaded files in public directories.