Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.8.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The Depicter Popup & Slider Builder plugin for WordPress is affected. Users with Editor-level access or higher can upload files with executable extensions that bypass the plugin's weak file validation, which may allow stored scripts to run on the site and, depending on server configuration, allow arbitrary code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Unknown Depicter — Popup & Slider Builder
From 4.0.5 · fixed in 4.8.2