CVE-2026-113472 Depicter CVE debrief

Who should care

Site administrators and security teams responsible for WordPress installations with the Depicter — Popup & Slider Builder plugin, especially those with Editor-level user accounts, should prioritize patching or mitigating this vulnerability. They should review the public uploads directory for suspicious files, monitor for potential script execution, and verify the affected versions.

Why it matters

The Depicter — Popup & Slider Builder WordPress plugin vulnerability allows arbitrary file uploads, leading to potential stored script execution and code execution. Defenders should prioritize patching, restrict file uploads, and monitor for suspicious activity.

• Potential stored script execution in the site origin
• Possible code execution depending on server handler mapping
• Increased risk for sites with Editor-level user accounts
• Need for verification of affected versions and remediation

Technical summary

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files, allowing users with the Editor role and above to upload malicious files into the public uploads directory. This vulnerability can lead to stored script execution and potential code execution, depending on the server's handler mapping. The plugin's insufficient validation of uploaded files, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, enables the arbitrary file upload vulnerability.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for sites with Editor-level user accounts.

Recommended defensive actions

• Patch Depicter — Popup & Slider Builder to version 4.8.2 or later
• Restrict file uploads to trusted users and validate file types
• Monitor for suspicious activity in the public uploads directory
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation and impact is limited. Defenders should verify the affected versions, review the public uploads directory for suspicious files, and monitor for potential script execution. The vulnerability allows arbitrary file uploads, which can lead to stored script execution and potential code execution. There is no evidence of public exploitation, but defenders should remain vigilant.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.