PT-2026-78890 · WordPress · Popup/Slider Builder By Depicter
CVE-2026-15049
·
Published
2026-08-20
·
Updated
2026-08-20
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Depicter — Popup & Slider Builder WordPress plugin versions prior to 4.8.0
Description
Users with editor-level access can upload arbitrary files, including executable PHP scripts, into a web-accessible directory. This occurs because the import feature fails to validate the type of uploaded files and does not remove malformed uploads, potentially leading to remote code execution.
Recommendations
Update Depicter — Popup & Slider Builder WordPress plugin to version 4.8.0 or later.
Exploit
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Popup/Slider Builder By Depicter