The Depicter – Popup & Slider Builder plugin for WordPress is vulnerable to generic SQL Injection through the 's' parameter in all versions up to and including 3.6.1. This weakness stems from insufficient escaping of user input and the absence of prepared statements, which permits an attacker to inject additional SQL clauses into existing queries. Untouched, this flaw enables unauthorized parties to read sensitive data from the database.

Vulnerable systems are WordPress installations running any version of the Depicter plugin up to 3.6.1. The vendor is Averta, and the product is the Depicter — Popup & Slider Builder plugin.

The exploitability of this flaw is substantial, as the attack requires no authentication and can be triggered remotely via the plugin’s Ajax endpoint. A CVSS score of 7.5 reflects a high severity, while an EPSS score of 48% indicates a notable likelihood of exploitation. As of the latest data, this vulnerability is not listed in CISA’s KEV catalog. Attackers can craft a malicious 's' parameter value to append arbitrary SQL statements, potentially exposing the database contents.