Depicter Popup Slider Builder
Monthly
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.