Depicter WordPress Plugin EUVD-2026-108598

Requires an authenticated account with the Editor role or above (PR:L) reaching the plugin's editor media-upload endpoint; the attacker uploads a file whose active extension is neither caught by the client-supplied MIME check nor by the case-sensitive .php block (so, e.g., alternate active extensions or case variants of php). Guaranteed outcome is stored script execution in the public uploads directory within the site origin. Escalation to server-side code execution is further conditioned on the web server's handler mapping actually executing the uploaded extension - a deployment-specific, often non-default factor. Limiting factors: the Editor-or-above privilege barrier (not exploitable by subscribers/anonymous users), no CVSS-indicated user interaction, and the conditional handler mapping that bounds the worst-case impact.

This is a medium-severity, authenticated file-upload flaw (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) whose real-world urgency is moderate rather than critical. The CVSS vector requires PR:L, which the description substantiates: only users already holding the Editor role or above can reach the vulnerable media-upload endpoint, so this is not a pre-auth internet-wide bug despite AV:N. The SSVC decision framework agrees it is not yet urgent - Exploitation: none, Automatable: no, Technical Impact: partial - and there is no CISA KEV listing and no public exploit identified at time of analysis. EPSS is not provided in the input, so exploitation probability cannot be quantified here. The vendor-priority label is 'this_month', consistent with a real but non-emergency issue. The most important nuance is conditionality: the description guarantees stored script execution in the site origin (matching C:L/I:L), but escalation to server-side code execution is explicitly gated on 'the server's handler mapping' - i.e., non-default configurations that execute the chosen extension - so the headline 'RCE' tag overstates the guaranteed impact for a default deployment. Net: a legitimate patch-this-month item, not a drop-everything emergency, with the Editor-role requirement as the principal limiting factor.

An attacker who already controls an Editor-or-higher account (via compromised credentials, a malicious insider, or a lower-priv account escalated through another flaw) uploads a file with an active server-side extension through the Depicter editor media-upload endpoint, defeating the client-MIME and case-sensitive .php checks. The file lands in the public uploads directory and executes as script in the site origin; where the web server's handler mapping runs the uploaded extension, this becomes server-side code execution. No public exploit is identified at time of analysis, and no user interaction beyond the attacker's own authenticated session is needed.