The Depicter Popup & Slider Builder WordPress plugin contains an insufficient file‑validation flaw in its editor media‑upload endpoint. The plugin only checks the MIME type supplied by the client and searches for a case‑sensitive block of the ".php" extension, ignoring the actual uploaded file content. This allows authenticated users with the Editor role or higher to upload files of any active extension into the public upload directory. Those uploaded files can then be executed by the web server, leading to stored script execution in the context of the site’s origin. The consequence is remote code execution, which can completely compromise the affected WordPress installation.

Any WordPress site running Depicter Popup & Slider Builder versions 4.0.5 through 4.8.1 is vulnerable. The plugin is developed by unknown maintainers (listed as Unknown:Depicter). The issue exists in all affected versions prior to 4.8.2, and no specific patch versions are listed in the vulnerability data. Site administrators should verify the version installed and upgrade if possible.

The vulnerability yields full code‑execution with no additional prerequisites beyond having Editor or higher role. The CVSS score is 5.4, indicating a medium severity, but the presence of arbitrary file upload and the ability to execute code still represent a serious risk. The EPSS score is not available, and the issue is not listed in CISA KEV. Attackers would exploit the media‑upload interface, which is typically accessible through the WordPress admin dashboard or API. Since the upload directory is publicly reachable, any uploaded script could be accessed directly, amplifying the exploitability.