The vulnerability is a missing capability check in the RulesAjaxController’s store function. The likely attack vector involves an unauthenticated user crafting an AJAX request to this endpoint, enabling the modification of pop‑up display settings. The flaw is classified as CWE‑862 (Missing Authorization). Based on the description, it is inferred that an attacker could alter which content appears in pop‑ups or sliders, potentially defacing a site or redirecting visitors to malicious pages. It does not provide code execution but changes the integrity and content of the website.

All installations of the Depicter – Popup & Slider Builder plugin by Averta with a version of 4.0.7 or earlier are affected. The plugin is a WordPress add‑on that manages pop‑ups, modals, and sliders.

The CVSS score is 5.3, indicating a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires unauthenticated access to the WordPress site and the ability to send a crafted AJAX request to the RulesAjaxController’s store endpoint. Based on the description, it is inferred that once it succeeds, the attacker can modify popup display rules, which could be used to display spam or misleading content.