CVE-2025-8383: Depicter <= 4.0.4 - Cross-Site Request Forgery
The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8383?
CVE-2025-8383 is a medium severity vulnerability due to the potential for unauthenticated attackers to perform actions on behalf of users.
How do I fix CVE-2025-8383?
To fix CVE-2025-8383, update the Depicter plugin for WordPress to version 4.0.5 or later where the nonce validation issue has been addressed.
What type of vulnerability is CVE-2025-8383?
CVE-2025-8383 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Which versions of the Depicter plugin are affected by CVE-2025-8383?
CVE-2025-8383 affects all versions of the Depicter plugin for WordPress prior to or equal to version 4.0.4.
Can CVE-2025-8383 be exploited by authenticated users?
No, CVE-2025-8383 can be exploited by unauthenticated users, making it particularly concerning.