Depicter WordPress Plugin CVE-2026-15049

Exploitation requires an authenticated WordPress account with at minimum editor-level privileges - this is the single most important limiting factor. The vulnerable code path is the Depicter plugin's import feature, which must be installed, active, and accessible to the authenticated session. Sites are at risk only if an editor (or higher) account is compromised, malicious, or granted to untrusted users. No special server configuration or non-default plugin settings are required beyond having the plugin active. What prevents unauthenticated or low-privilege exploitation: the CVSS PR:H metric confirms that users without editor credentials cannot reach the import endpoint, and SSVC's 'automatable: no' classification reflects that credential acquisition cannot be automated at scale, ruling out mass exploitation campaigns.

The NVD CVSS 3.1 score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H correctly reflects that while the C/I/A impact is maximal post-exploitation, the PR:H metric - requiring editor-level WordPress credentials - is the primary risk limiter. SSVC classifies exploitation as 'none' and automatable as 'no,' directly consistent with the PR:H barrier preventing mass scanning campaigns. Notably, SSVC rates technical impact as 'partial' despite CVSS showing C:H/I:H/A:H - this discrepancy likely reflects SSVC's organizational scope assessment versus CVSS's per-system view; both readings are defensible. A publicly available POC from WPScan elevates practical risk for sites where editor accounts are shared, weakly protected, or granted to partially trusted parties. No CISA KEV listing means no confirmed widespread exploitation. Overall: this is a high-priority patch for multi-editor WordPress environments; lower urgency for sites with tightly controlled or single-user editor access.

An attacker who holds (or has compromised) a WordPress editor-level account navigates to the Depicter plugin's import feature and submits a crafted payload containing a PHP webshell with a non-blocked extension or within a malformed archive. Because the plugin does not validate the file type and does not clean up the upload on failure, the PHP file is written to a web-accessible directory. The attacker then sends an HTTP GET request directly to that file's URL, triggering server-side PHP execution and achieving full remote code execution under the web server process's privileges. A publicly available POC from WPScan documents this technique.