# Depicter — Popup & Slider Builder <= 4.8.1 - Authenticated (Editor+) Arbitrary File Upload

- **ID:** WPSEC-2026-1031
- **Plugin:** Depicter — Popup & Slider Builder (`depicter`), https://wordpress.org/plugins/depicter/
- **Affected versions:** all versions before 4.8.2
- **Fixed in:** 4.8.2 (Update to 4.8.2 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/depicter
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1031/

## Description

The Depicter plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 4.8.1. This is due to the plugin's media upload handler accepting the MIME type sent with the request instead of checking the real type of the uploaded file, and rejecting only one dangerous file extension by name. This makes it possible for authenticated attackers, with editor-level access and above, to upload files of types WordPress does not allow to the affected site's server, which may make remote code execution possible.

## References

- https://wpsec.com/vuln/WPSEC-2026-1031/
- https://plugins.svn.wordpress.org/depicter/tags/4.8.2/
- https://wordpress.org/plugins/depicter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1031/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.