CVE-2026-113472 in Depicter Plugin
Summary
by MITRE • 10/23/2026
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in The Depicter — Popup & Slider Builder WordPress plugin prior to version 4.8.2 represents a critical security flaw rooted in insufficient input validation within its media upload functionality. This issue specifically affects the editor media-upload endpoint, which is designed to handle file uploads for creating and managing visual elements such as popups and sliders. The core technical deficiency lies in how the application processes uploaded files during this operation. Instead of performing robust server-side verification that includes content inspection or strict extension whitelisting independent of client input, the plugin relies primarily on two weak checks: it accepts the MIME type provided by the client side without validating its authenticity against the actual file contents, and it only blocks filenames ending in .php when checked with case-sensitive logic. This approach fails to account for alternative executable extensions commonly used in web server environments or bypasses simple string matching through case variation techniques that might not be fully covered if the implementation is rigidly tied to lowercase checks without comprehensive normalization.
From a technical perspective, this flaw allows authenticated users possessing at least Editor-level privileges to upload malicious files into the public uploads directory of the WordPress installation. Because these directories are typically web-accessible and often configured to execute scripts depending on server settings such as Apache mod_php or Nginx PHP-FPM configurations, an attacker can exploit this by uploading a file with a dangerous extension like .php, .phtml, or even executable formats if supported by the environment. The reliance on client-supplied MIME types is particularly dangerous because attackers can easily spoof these headers using standard HTTP manipulation tools to make malicious scripts appear as harmless image files during transmission. Furthermore, the case-sensitive check for the .php extension suggests that variations such as .PHP, .PhP, or other permutations might bypass the filter if not explicitly handled by a more comprehensive validation routine. This lack of strict enforcement creates an opportunity for stored cross-site scripting and remote code execution attacks.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and persistent compromise. An attacker who gains access through compromised editor credentials or exploits other vulnerabilities to achieve that level can upload web shells, which are malicious scripts designed to provide interactive command-line access to the server. Once uploaded, these files reside in a publicly accessible directory, allowing them to be invoked directly via HTTP requests without requiring further authentication for execution. This leads to stored script execution on the site origin, meaning the malicious code persists and executes every time it is accessed or triggered by specific conditions defined within the payload. Depending on the server's handler mapping and configuration, this can escalate from simple client-side attacks like cross-site scripting to full remote code execution, granting the attacker control over the underlying operating system, access to sensitive database credentials stored in wp-config.php, and the ability to pivot into other systems within the network infrastructure.
This vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, as well as CWE-20, indicating improper input validation where external data is not sufficiently verified before use. In terms of attack vectors, it maps directly to MITRE ATT&CK technique T1505.003, known as Web Shell: ASPX, though applicable to any server-side scripting language supported by the target environment, and falls under the broader category of Initial Access via Valid Accounts (T1078) if achieved through credential theft or abuse. The persistence mechanism is consistent with T1505, allowing attackers to maintain long-term access even after initial detection efforts are undertaken.
Mitigation strategies must focus on immediate remediation and enhanced security controls. The primary action required is upgrading the plugin to version 4.8.2 or later, where these validation issues have been addressed by implementing stricter file type checking that includes content verification rather than relying solely on headers and extensions. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations should include restricting upload permissions for editor-level users if possible, configuring web servers to disable script execution in the uploads directory through specific configuration directives such as denying PHP execution via .htaccess rules or Nginx location blocks, and implementing a Web Application Firewall that can detect and block attempts to execute scripts from non-standard directories. Additionally, enforcing multi-factor authentication for all administrative accounts reduces the risk of credential compromise leading to this exploitation path. Regular auditing of uploaded files and monitoring server logs for unusual activity in public directories are also recommended practices to detect potential breaches early.