CVE-2026-15049

HighCVSS 7.2

Published: 20/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

42th percentile - higher than 42% of all known CVEs

Summary

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate file types during import and does not remove malformed uploads, allowing editor-level users to write arbitrary files (including executable PHP) to a web-accessible directory, leading to remote code execution.

Risk Assessment

Risk of remote code execution and full compromise of the WordPress site.

Recommendation

Update the plugin to version 4.8.0 or later and restrict editor-level permissions.

Other vulnerabilities in Depicter

CVE-2025-8383Medium
The Depicter plugin for WordPress up to version 4.0.4 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the depicter-document-rules-store function. This allows unauthenticated attackers to modify document rules via a forged request if they can trick a site administrator into clicking a link.

Original NVD description (English source)

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS