Vulnerabilities / Depicter — Popup & Slider Builder / WPSEC-2026-1031
Depicter — Popup & Slider Builder <= 4.8.1 - Authenticated (Editor+) Arbitrary File Upload
High 7.2
CWE-434Fixed in 4.8.2
- ID
- WPSEC-2026-1031
- Plugin
- Depicter — Popup & Slider Builder (depicter)
- Affected
- all versions before 4.8.2
- Remediation
- Update to 4.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- Depicter — Popup & Slider Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Depicter plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 4.8.1. This is due to the plugin's media upload handler accepting the MIME type sent with the request instead of checking the real type of the uploaded file, and rejecting only one dangerous file extension by name. This makes it possible for authenticated attackers, with editor-level access and above, to upload files of types WordPress does not allow to the affected site's server, which may make remote code execution possible.
References
- https://wpsec.com/vuln/WPSEC-2026-1031/
- https://plugins.svn.wordpress.org/depicter/tags/4.8.2/
- https://wordpress.org/plugins/depicter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS