CVE-2026-113472: CWE-434 Unrestricted Upload of File with Dangerous Type in Depicter — Popup & Slider Builder

The Depicter — Popup & Slider Builder WordPress plugin before version 4.8.2 contains an unrestricted file upload vulnerability (CWE-434) due to insufficient validation of uploaded files. The plugin only checks the MIME type provided by the client and blocks the .php extension in a case-sensitive manner, which can be bypassed by using other executable extensions. Users with Editor or higher privileges can exploit this to upload malicious files to the public uploads directory, leading to stored script execution and possible remote code execution depending on the server's handler mappings.

An attacker with Editor role or higher privileges can upload malicious files with executable extensions to the public uploads directory. This can lead to stored script execution within the site origin and potentially remote code execution on the server, depending on how the server handles these file types. This elevates the risk of site compromise and unauthorized code execution.

A fix is available in Depicter — Popup & Slider Builder version 4.8.2 and later. Users should upgrade to version 4.8.2 or above to remediate this vulnerability. Until then, restrict upload permissions to trusted users and consider additional server-side validation or filtering of uploaded files to prevent execution of unauthorized scripts.