Live › vulnerability › CVE-2026-113472
Go to dashboardThe Depicter Popup and Slider Builder WordPress plugin before 4.8.2 checks only the client-supplied MIME type and a case-sensitive .php extension block on its editor media upload endpoint. An editor-level user can upload files with other active extensions into the public uploads directory, which allows stored script execution and possibly code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Depicter Popup and Slider Builder plugin before 4.8.2 where users with the Editor role or higher can reach the plugin's media upload endpoint. The risk is greatest on servers whose handler mapping runs unusual extensions from the uploads directory. Sites without the plugin, or with it already at 4.8.2 or later, are not affected.
No product ranges from the sources yet.
wp plugin get depicter --field=version.phtml, .php5, .phar or mixed-case .PHP) under wp-content/uploads4.8.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-113472")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.