Depicter Slider CVE-2026-66622

Exploitation requires the Depicter Slider plugin by Averta to be installed and active on a WordPress instance that is reachable over the network. The CVSS vector confirms the attack is unauthenticated (PR:N) and requires no user interaction (UI:N), so no victim account or action is a prerequisite. Attack Complexity is rated High (AC:H), indicating that specific technical conditions beyond the attacker's immediate control must be satisfied - the precise nature of these conditions (such as particular request parameters, timing, or plugin configuration states) is not specified in the Patchstack advisory data available. No non-default plugin configuration is stated as required, but the AC:H rating limits opportunistic or fully automated mass exploitation. Exploitation is constrained to environments where the plugin is actively installed; sites not using Depicter Slider are unaffected.

The CVSS 7.5 score captures a meaningful but nuanced risk profile: network-accessible (AV:N) with no privilege or interaction requirement (PR:N, UI:N) makes this broadly reachable in principle, yet Attack Complexity is rated High (AC:H), indicating that exploitation requires non-trivial technical conditions - such as precise payload construction, timing constraints, or specific plugin state - that are not entirely under attacker control. The scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can read across the entire WordPress database, not merely the plugin's own tables. No EPSS probability data was provided in the available intelligence, and the vulnerability is absent from the CISA KEV catalog, so confirmed mass or automated exploitation has not been observed. Even a mid-sized municipal IT team in tczew should treat this as urgent if the plugin is deployed, because the unauthenticated vector means no account compromise is needed as a precondition. The AC:H metric is the primary moderating factor separating this from a critical-tier finding - it reduces the likelihood of fully automated, opportunistic exploitation, but skilled manual attackers or those with established tooling may still meet the exploitation bar.

An unauthenticated remote attacker identifies a WordPress site running Depicter Slider <= 4.8.0, then crafts an HTTP request targeting the vulnerable plugin endpoint with a malicious SQL payload designed to satisfy the AC:H exploitation conditions - such as specific parameter combinations or request sequencing. Upon success, the attacker executes arbitrary SQL against the WordPress database and extracts sensitive records including hashed user passwords and email addresses, enabling follow-on account compromise. No public exploit code has been identified at time of analysis, meaning independent technical capability is currently required to meet the exploitation bar.