The vulnerability arises from missing or incorrect nonce validation on the depicter-document-rules-store function in the Depicter WordPress plugin. Because the request is not properly authenticated, an attacker who can trick a site administrator into visiting a crafted URL can change document rules without legitimate credentials. The impact is limited to modification of content rules, but it can alter how sliders and pop‑ups behave, potentially enabling further attacks or disrupting site functionality. The flaw is identified as a CSRF weakness (CWE‑352).

The defect exists in the Depicter Popup & Slider Builder plugin by averta for WordPress, affecting all releases up to and including version 4.0.4. Administrators running these vulnerable versions are at risk; users of newer releases are unaffected.

The CVSS score of 4.3 places the issue in the medium severity range. An EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread attacks. Likely exploitation would require social engineering to get an admin to click a malicious link, after which the forged request would update rule settings.