CVE-2026-113472: Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload

Q: Who can exploit this issue?

An authenticated WordPress user with the Editor role or a higher-privileged role can exploit the vulnerable editor media-upload endpoint. The issue is therefore most relevant where Editor-level accounts are assigned to untrusted users or could be compromised.

Q: Are default uploads necessarily enough to achieve code execution?

No. The vulnerable plugin allows upload of files with active extensions other than lowercase .php into the public uploads directory, enabling stored script execution in the site origin. Whether this becomes server-side code execution depends on the server's handler mapping for the uploaded extension.

Q: What is the affected version range?

Versions 4.0.5 through 4.8.1 are affected. Version 4.8.2 is identified as the version before which the upload validation issue exists.

Q: What can be done if the plugin cannot be updated immediately?

Restrict access to Editor and higher roles to trusted users, since those roles can reach the affected upload endpoint. Review the public uploads directory for unexpected files using active extensions, especially extensions that your web server may execute.

Published Oct 23, 2026

Updated

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.

Affected Software

1 affected component

Depicter — Popup & Slider Builder WordPress plugin>=4.0.5<=4.8.1

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with the Editor role or a higher-privileged role can exploit the vulnerable editor media-upload endpoint. The issue is therefore most relevant where Editor-level accounts are assigned to untrusted users or could be compromised.

Are default uploads necessarily enough to achieve code execution?

No. The vulnerable plugin allows upload of files with active extensions other than lowercase .php into the public uploads directory, enabling stored script execution in the site origin. Whether this becomes server-side code execution depends on the server's handler mapping for the uploaded extension.

What is the affected version range?

Versions 4.0.5 through 4.8.1 are affected. Version 4.8.2 is identified as the version before which the upload validation issue exists.

What can be done if the plugin cannot be updated immediately?

Restrict access to Editor and higher roles to trusted users, since those roles can reach the affected upload endpoint. Review the public uploads directory for unexpected files using active extensions, especially extensions that your web server may execute.

CVE-2026-113472: Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default uploads necessarily enough to achieve code execution?

What is the affected version range?

What can be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default uploads necessarily enough to achieve code execution?

What is the affected version range?

What can be done if the plugin cannot be updated immediately?