CVE-2026-113472
Last modified
CVE-2026-113472 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution..
Description
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Depicter — Popup & Slider Builder | >= 4.0.5, < 4.8.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-113472?
How severe is CVE-2026-113472?
How do I fix CVE-2026-113472?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-113465It is possible to execute a DOM-based Cross-Site Scripting a…6.6
- CVE-2026-113466A security vulnerability has been detected in MinIO up to RE…5.3
- CVE-2026-113468The payment notification endpoint for PayPal accepts incomin…6.9
- CVE-2026-113469A failure has been identified in the SNS during dynamic data…7.5
- CVE-2026-11347The linqi application contains hardcoded cryptographic keys.…8.5
- CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists…5.4
- CVE-2026-11348Improper verification of cryptographic signature vulnerabili…8.1
- CVE-2026-113481The Media Library Assistant WordPress plugin before 3.44 doe…4.3
- CVE-2026-113482The Media Library Assistant WordPress plugin before 3.44 doe…6.8
- CVE-2026-113485The Media Library Assistant WordPress plugin before 3.42 doe…6.5
- CVE-2026-113486The Media Library Assistant WordPress plugin before 3.42 doe…6.5
- CVE-2026-113487The GeoDirectory WordPress plugin before 2.8.196 does not p…6.8
Are you affected by CVE-2026-113472?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST