CVE-2023-6493 in Depicter Slider Plugin
Summary
by MITRE • 01/05/2024
The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/11/2026
The Depicter Slider plugin for WordPress represents a widely used tool for creating responsive image sliders, video sliders, and post sliders on websites. This plugin has been identified as vulnerable to Cross-Site Request Forgery attacks affecting all versions up to and including 2.0.6. The vulnerability stems from inadequate security controls within the plugin's administrative functionality, specifically in the 'save' function where nonce validation is either missing or improperly implemented. This flaw creates a significant security risk for WordPress installations that utilize this plugin, as it allows unauthorized parties to manipulate plugin configurations without proper authentication. The vulnerability is particularly concerning because it does not require authentication from the attacker, making it accessible to anyone who can influence an administrator's actions. The issue manifests when an attacker crafts a malicious request that, when executed by an authenticated administrator, modifies the plugin's configuration settings. This type of vulnerability directly aligns with CWE-352, which categorizes Cross-Site Request Forgery vulnerabilities as those that permit unauthorized commands from a user who is authenticated to a web application. The attack vector typically involves social engineering tactics where administrators are tricked into clicking on malicious links or visiting compromised websites that automatically submit requests to the vulnerable plugin. The operational impact of this vulnerability extends beyond simple configuration changes, as compromised plugin settings could potentially affect website performance, content presentation, or even provide attackers with additional attack surfaces within the WordPress environment. According to ATT&CK framework category T1566, this vulnerability represents a technique for initial access through social engineering, while also falling under T1059 for command and scripting interpreter usage. The lack of proper nonce validation creates a persistent risk that remains active until the plugin is updated to a secure version. The duplicate CVE identifier CVE-2023-51491 confirms the severity and scope of this particular vulnerability, indicating that multiple reporting sources have validated the same underlying flaw. Organizations using this plugin should immediately implement mitigation strategies including updating to the latest secure version, implementing additional access controls, and monitoring for unauthorized configuration changes. The vulnerability demonstrates the critical importance of proper input validation and nonce implementation in WordPress plugin development, as these security measures serve as fundamental barriers against unauthorized administrative actions. Without adequate protection mechanisms, even legitimate plugin features can become attack vectors that compromise entire website infrastructures. Security professionals should also consider implementing web application firewalls and monitoring solutions to detect potential exploitation attempts of this CSRF vulnerability. The widespread adoption of this plugin increases the attack surface for malicious actors who may leverage this vulnerability to establish persistent access or cause disruption to website operations. Regular security audits of WordPress installations should include verification of plugin integrity and proper implementation of security controls to prevent similar vulnerabilities from compromising system security.