Vulnerability in Depicter — Popup & Slider Builder — CVE-2026-113472

What to do now

Update Depicter — Popup & Slider Builder to 4.8.2 or later.

Affected versions

• 4.0.5 to 4.8.1 (inclusive)

The Depicter — Popup & Slider Builder plugin for WordPress is vulnerable to Arbitrary File Upload in versions 4.0.5 through 4.8.1. This is due to missing file type validation. This makes it possible for authenticated attackers, with editor-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.

This description is reproduced verbatim from the public vulnerability record.

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0c6a63-7dd7-49ae-a09d-28e044100c64?source=api-prod

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0c6a63-7dd7-49ae-a09d-28e044100c64
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.