Description
Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated SQL Injection vulnerability exists in Depicter Slider versions 4.8.0 and earlier. Attackers can submit specially crafted SQL statements through the plugin’s input fields, which are then executed against the WordPress database. This allows the attacker to read, modify, or delete data stored in the database. The weakness is classified as CWE-89, indicating a classic injection flaw.

Affected Systems

The Depicter Slider plugin released by averta for WordPress is affected. All releases of version 4.8.0 and earlier are vulnerable. Sites that have installed these versions face this risk.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA KEV, indicating no publicly documented exploits to date. The attack vector is likely remote via crafted HTTP requests to the plugin’s endpoints, allowing an attacker to inject arbitrary SQL commands.

Generated by OpenCVE AI on August 18, 2026 at 18:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Depicter Slider plugin to a version newer than 4.8.0 that eliminates the SQL injection flaw.
  • If an immediate update is not possible, restrict access to the plugin’s administrative interfaces to trusted accounts and disable public access using role‑based access control.
  • Deploy a Web Application Firewall or configure server rules (e.g., in .htaccess) to detect and block suspicious SQL payloads targeting the plugin’s input fields.

Generated by OpenCVE AI on August 18, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Averta
Averta depicter Slider
Wordpress
Wordpress wordpress
Vendors & Products Averta
Averta depicter Slider
Wordpress
Wordpress wordpress

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
Title WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Averta Depicter Slider
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-18T19:48:23.446Z

Reserved: 2026-07-27T14:00:21.730Z

Link: CVE-2026-66622

cve-icon Vulnrichment

Updated: 2026-08-18T19:40:14.895Z

cve-icon NVD

Status : Deferred

Published: 2026-08-18T15:16:57.430

Modified: 2026-08-20T12:48:31.843

Link: CVE-2026-66622

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T18:15:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')