Improper File Upload Vulnerability in Depicter Popup & Slider Builder Plugin by WordPress
CVE-2026-113472
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-113472?
The Depicter – Popup & Slider Builder WordPress plugin versions prior to 4.8.2 exhibit a flaw in the file upload functionality. The plugin inadequately validates file uploads via its editor media-upload endpoint, relying solely on the client-reported MIME type and an improperly configured check for the .php extension. This oversight permits users with Editor privileges and higher to upload files with various active extensions to the public uploads directory. As a result, it may lead to stored script execution, and depending on the server's configuration regarding handler mapping, it poses a risk of arbitrary code execution within the site's environment.
Affected Version(s)
Depicter — Popup & Slider Builder 4.0.5 < 4.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.