File Upload Vulnerability in Depicter Popup & Slider Builder by WordPress
CVE-2026-15049

Currently unrated

Key Information:

Vendor

WordPress
Status
Depicter — Popup & Slider Builder
Vendor
CVE Published:
20 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15049?

The Depicter — Popup & Slider Builder WordPress plugin, prior to version 4.8.0, is susceptible to a file upload vulnerability. The plugin does not appropriately validate the type of files uploaded through its import feature, allowing users with editor-level access to upload malicious files, including executable PHP scripts, to a public directory. This oversight can result in remote code execution, posing a severe risk to websites utilizing the plugin and potentially compromising server security.

Affected Version(s)

Depicter — Popup & Slider Builder 0 < 4.8.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15049 - Proof of Concept

References

https://wpscan.com/vulnerability/c32e6a11-98f2-48e8-be64-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

md. minaruzzaman shovon
WPScan
.