CVE-2024-0757: Articulate Content Plugin RCE Vulnerability

CVE-2024-0757 Overview

CVE-2024-0757 affects the Insert or Embed Articulate Content into WordPress plugin through version 4.3000000023. The plugin fails to validate file extensions inside imported zip archives. Authenticated users with low-level privileges can upload zip files containing malicious code disguised as Articulate content. This unrestricted file upload weakness maps to [CWE-434] and creates a path to remote code execution on the underlying server. The flaw exists because the import handler trusts the contents of user-supplied archives without enforcing an allowlist of safe file extensions.

Critical Impact

Authenticated attackers can upload arbitrary executable files inside zip archives, leading to potential code execution within the WordPress environment.

Affected Products

• Elearningfreak Insert or Embed Articulate Content into WordPress plugin
• All versions through 4.3000000023
• WordPress installations using the vulnerable plugin

Discovery Timeline

• 2024-06-04 - CVE-2024-0757 published to NVD
• 2025-05-21 - Last updated in NVD database

Technical Details for CVE-2024-0757

Vulnerability Analysis

The Insert or Embed Articulate Content plugin allows WordPress users to import zip archives containing Articulate Storyline or Rise course content. The import routine extracts the archive contents into the WordPress uploads directory. The plugin does not enforce an allowlist of permitted file extensions on files contained inside the zip. An attacker can craft a zip archive containing PHP, phtml, or other executable file types alongside legitimate course assets. After import, the malicious files reside in a web-accessible directory and can be requested directly through the browser.

The EPSS score of this issue indicates that exploitation activity is being observed or anticipated against vulnerable WordPress hosts. The vulnerability falls into the Unrestricted File Upload category and aligns with [CWE-434]: Unrestricted Upload of File with Dangerous Type.

Root Cause

The root cause is missing extension validation during zip extraction. The plugin inspects the outer archive but does not verify the file types contained within. There is no server-side allowlist limiting extraction to expected Articulate assets such as .html, .js, .css, .swf, .xml, or media files. Any file extension inside the archive is preserved and written to disk.

Attack Vector

Exploitation requires an authenticated WordPress account with permission to use the plugin's import functionality. The attacker constructs a zip archive containing a PHP webshell or other executable script. The attacker then uses the plugin's import feature to upload the archive. The plugin extracts the archive into the uploads directory. The attacker requests the extracted payload over HTTP to trigger execution within the WordPress process. The result is arbitrary code execution under the privileges of the web server.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-0757

Indicators of Compromise

• New PHP, phtml, or other executable files appearing under wp-content/uploads/ paths used by the plugin
• Unexpected zip imports in plugin logs from non-administrator accounts
• Outbound network connections originating from the web server process to unknown destinations following a plugin import event
• WordPress audit log entries showing plugin import actions followed by direct HTTP requests to newly created files

Detection Strategies

• Inventory WordPress installations and identify those running insert_or_embed_articulate_content at or below version 4.3000000023
• Monitor file creation events under WordPress upload directories for non-media file extensions
• Inspect zip files submitted to the plugin's import endpoint for executable content prior to extraction
• Correlate plugin import HTTP requests with subsequent requests to newly created files in the uploads tree

Monitoring Recommendations

• Enable web server access logging and alert on requests to .php files inside wp-content/uploads/
• Forward WordPress audit logs to a centralized logging platform for retrospective analysis
• Track child processes spawned by the PHP-FPM or Apache worker to identify post-exploitation activity
• Establish a baseline of legitimate plugin upload activity and alert on deviations

How to Mitigate CVE-2024-0757

Immediate Actions Required

• Update the Insert or Embed Articulate Content plugin to a version newer than 4.3000000023 once a fixed release is available
• Restrict plugin import capability to trusted administrator accounts only
• Audit wp-content/uploads/ for unexpected PHP or executable files and remove any unauthorized content
• Rotate WordPress credentials and API keys if compromise is suspected

Patch Information

Review the WPScan Vulnerability Report for current vendor patch status. At the time of NVD publication, the advisory references versions through 4.3000000023 as vulnerable. Apply vendor updates as soon as a fixed release is published.

Workarounds

• Disable or remove the plugin until a patched version is installed
• Configure web server rules to deny execution of PHP files inside wp-content/uploads/ directories
• Limit plugin access through role-based access control and remove import permissions from low-privilege users
• Place a web application firewall in front of the WordPress site to inspect and block zip uploads containing executable file types

# Apache: deny PHP execution inside the WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar)$">
        Require all denied
    </FilesMatch>
</Directory>