{
 "id": "WPSEC-2026-1031",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1031/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1031/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1031/index.md",
 "title": "Depicter — Popup & Slider Builder <= 4.8.1 - Authenticated (Editor+) Arbitrary File Upload",
 "description": "The Depicter plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 4.8.1. This is due to the plugin's media upload handler accepting the MIME type sent with the request instead of checking the real type of the uploaded file, and rejecting only one dangerous file extension by name. This makes it possible for authenticated attackers, with editor-level access and above, to upload files of types WordPress does not allow to the affected site's server, which may make remote code execution possible.",
 "plugin": {
  "slug": "depicter",
  "name": "Depicter — Popup & Slider Builder",
  "full_name": "Depicter — Popup & Slider Builder",
  "wordpress_org": "https://wordpress.org/plugins/depicter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/depicter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/depicter"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.8.2",
 "remediation": "Update to 4.8.2 or later.",
 "fix_released": "2026-10-14T13:07:49+00:00",
 "published": "2026-10-15T13:50:16+00:00",
 "updated": "2026-10-14T19:51:31.580987+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1031/",
  "https://plugins.svn.wordpress.org/depicter/tags/4.8.2/",
  "https://wordpress.org/plugins/depicter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/depicter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-15"
 }
}