The Depicter – Popup & Slider Builder plugin for WordPress allows authenticated users with Contributor-level access to upload files through a specific AJAX endpoint because the code lacks proper capability checks. The files that can be uploaded are limited to certain safe file types, yet an attacker could still use them to host malicious content or compromise the site’s media library. This flaw does not grant arbitrary code execution outright, but it gives the attacker a foothold for content injection or further attacks if additional vulnerabilities exist. The absence of authorization controls is a classic access‑control weakness, as identified by CWE‑862. This scenario can lead to unintended breakdown of confidentiality or integrity of the site’s data, and may open doors for phishing or defacement if a malicious file is placed in a public directory.

All installations of the Depicter – Popup & Slider Builder plugin from Averta with versions 4.0.4 and earlier are affected. The vulnerability is present in the "depicter-media-upload" AJAX route used for uploading media items such as images and other files. Users of newer releases (4.0.5 and above) are not impacted because the patch was applied after the public release of the version at issue.

With a CVSS score of 4.3, the severity is moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Because the control missing is an authorization check, any user who has been granted Contributor (or higher) permissions on a WordPress site can exploit the upload feature. While the attack vector requires the attacker to be an authenticated user with at least Contributor privileges, that role is often granted to many collaborators. If a site’s Contributor users are abused, the attacker could place spoofed images or other content that could trick visitors or create brand damage. The risk is amplified where such roles are widely distributed and where the site relies on uploaded media for public display.