Description

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-20T06:16:49.710Z",
  "pubdate": "2026-08-20T06:16:49.710Z",
  "executiveSummary": "The Depicter — Popup & Slider Builder WordPress plugin, in versions prior to 4.8.0, suffers from an arbitrary file upload vulnerability within its import feature. This security flaw enables authenticated attackers possessing editor-level privileges to upload arbitrary files, including executable PHP payloads, directly into a web-accessible directory on the hosting server.\nThe root cause stems from the application's failure to adequately validate the MIME type and file extension of uploaded files during the import process, coupled with improper cleanup mechanisms that leave malformed or malicious uploads intact on the filesystem.\nSuccessful exploitation of this vulnerability leads to Remote Code Execution (RCE) on the underlying web server, severely compromising the confidentiality, integrity, and availability of the entire WordPress installation. The risk implication is critical, as an attacker with administrative or editor-level access can leverage this capability to execute arbitrary system commands, establish persistent backdoors, and pivot deeper into the internal network infrastructure.",
  "technicalDetails": "The vulnerability resides within the file import functionality of the Depicter — Popup & Slider Builder WordPress plugin affecting versions before 4.8.0. The vulnerable component fails to implement rigorous input validation and type checking mechanisms on files submitted through the import interface.\nSpecifically, the application accepts multipart file uploads without verifying whether the file headers, extensions, or content types correspond to expected safe file formats (such as legitimate plugin backup or archive structures). Furthermore, the upload handler implements deficient error-handling and cleanup logic, meaning that malformed uploads or files containing malicious payloads are not purged from the storage destination upon processing failure or validation rejection.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker authenticated with editor-level privileges navigates to the plugin's import functionality interface. Second, the attacker crafts a multipart HTTP POST request containing a malicious payload, such as a web shell disguised as an archive or directly written as a raw PHP execution script (e.g., .php). Third, the vulnerable import handler processes the request, saves the uploaded file directly into a web-accessible directory on the server filesystem, and fails to strip or neutralize the executable extension.\nFinally, the attacker executes the uploaded payload by sending a direct HTTP request to the path of the newly written file via the web server. Because the file resides within a public-facing directory and contains valid PHP syntax, the web server executes the script within the security context of the web application user, resulting in full Remote Code Execution."
}