The Slider and Carousel slider by Depicter WordPress plugin versions up to 3.0.2 contain an incorrect authorization vulnerability (CWE-863) that permits authenticated users with contributor-level access or above to arbitrarily generate valid nonces for any WordPress action or function. Nonces are intended to protect against CSRF by validating user intent, but this flaw allows bypassing such protections by creating valid nonces without proper authorization. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality due to potential unauthorized action invocation. No patch or official remediation guidance is currently provided.

An attacker with contributor or higher privileges can generate valid nonces for any WordPress action or function, potentially enabling them to perform actions that rely solely on nonce validation for authorization. This could lead to unauthorized invocation of protected functionality, impacting the confidentiality of the affected system. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor and higher user roles to trusted individuals only. Monitor for updates from the plugin vendor and apply patches promptly once released.