Arbitrary file upload in Depicter WordPress plugin editor media upload
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
The Depicterrm Popup and Slider Builder WordPress plugin from 4.0.5 before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint. It checks only the client-supplied MIME type and a case-sensitive block of the .php extension, so a user with the Editor role or higher can upload files with other active extensions into the public uploads directory (CWE-434). Stored script execution in the site origin is possible, and depending on the server's handler mapping, code execution may follow.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Depicter — Popup & Slider Builder | 4.0.5 to before 4.8.2 | 4.8.2 | Patch available | CNA |
- Depicter — Popup & Slider Builder VendorUnknown Affected 4.0.5 to before 4.8.2 Fixed in 4.8.2 Patch available CNA
Remediation
Update Depicter Popup and Slider Builder to version 4.8.2 or later, which fixes the flaw. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Depicter — Popup & Slider Builder (Unknown) Fixed in 4.8.2
Timeline
- 2026-10-23 Threatist record created from CVE-2026-113472
- 2026-10-23 Alias added: GHSA-f92x-x728-fq7r
- 2026-10-23 CVSS score added · CISA ADP
- 2026-10-23 Weakness changed · CISA ADP
- 2026-10-23 CISA SSVC decision points changed
References
Sources
- CVE-2026-113472 · CVE Program
- CVE-2026-113472 · NVD
- FIRST EPSS
- GHSA-f92x-x728-fq7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences