EUVD-2026-60915
GHSA-mx2h-ccrv-9fr4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi reaching database tier (S:C, C:H); AC:H reflects non-trivial exploitation conditions; I:N consistent with read-only injection behavior implied by reporter's scoring.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
AnalysisAI
Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Depicter Slider plugin by Averta to be installed and active on a WordPress instance that is reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score captures a meaningful but nuanced risk profile: network-accessible (AV:N) with no privilege or interaction requirement (PR:N, UI:N) makes this broadly reachable in principle, yet Attack Complexity is rated High (AC:H), indicating that exploitation requires non-trivial technical conditions - such as precise payload construction, timing constraints, or specific plugin state - that are not entirely under attacker control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Depicter Slider to a version above 4.8.0; however, no specific patched release version has been independently confirmed in the available data - site administrators should consult the official WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/depicter/vulnerability/wordpress-depicter-slider-plugin-4-8-0-sql-injection-vulnerability to identify the current safe release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using Depicter Slider and document current plugin versions to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Depicter Slider
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today