Published October 23, 2026. Based on public CVE records available on that date; details may change.

CVE-2026-113472 is a file upload validation flaw in Depicter (Popup & Slider Builder) versions 4.0.5 through 4.8.1. A user with the Editor role or higher can upload files that should have been rejected, which can lead to script execution in your site's origin and, on some server setups, to code execution. Update Depicter to 4.8.2, then check who holds Editor access and what has landed in your uploads folder.

What happened

The Depicter editor has a media upload endpoint that does not validate files properly. According to the CVE record, the endpoint checks only the MIME type supplied by the client (the browser or whatever tool sends the request) and blocks the .php extension with a case-sensitive check.

Both checks are weak. A client-supplied MIME type is just a label the uploader chooses, so it says nothing reliable about what the file really is. A case-sensitive block on .php means other extensions that a server or browser may still treat as active content can get through.

The record says such files end up in the public uploads directory. From there, two outcomes are described:

  • Stored script execution in the site origin. A file served from your own domain can run script in a visitor's browser with your site's trust, including in the browser of a logged-in administrator.
  • Code execution on the server, depending on the server's handler mapping. Whether this is possible depends on how your web server decides which file extensions to execute.

The vendor's changelog for 4.8.2, released October 15, 2026, says the fix checks the real file type and extension instead of trusting the type sent by the browser. The same release also lists a separate fix for SVG animation attributes that could inject javascript: links. The CVE record reviewed here covers the upload issue only.

The CVE record does not include a CVSS score. The records reviewed for this article do not mention exploitation in the wild.

Who is affected

Sites running Depicter 4.0.5 up to, but not including, 4.8.2 are affected. Versions before 4.0.5 are not listed as affected in the record, and 4.8.2 is the fixed version. Depicter has 80,000+ active installations on WordPress.org as of October 23, 2026.

The attacker must already hold the Editor role or higher. That narrows the risk, but it does not remove it. Editor accounts are common on business sites, agencies often create them for contractors, and a reused or phished editor password gives an outsider the same access. If an attacker already has an administrator account, this flaw adds little; the concern is the gap between Editor and full control of the server.

How to check your site

Start with the version. In the WordPress dashboard, open Plugins and find Depicter. If WP-CLI is available, run wp plugin list --name=depicter from the WordPress directory to see the installed version and status.

Next, review who can reach the vulnerable endpoint:

  1. Open Users and filter by the Editor and Administrator roles, or run wp user list --role=editor and wp user list --role=administrator.
  2. Confirm every account belongs to a known person who still needs that access.
  3. Look for accounts you do not recognize. Our guide to finding hidden WordPress admin users covers accounts that do not show up in the normal list.

Then review the uploads folder for files that do not belong there. Images, PDFs, and other media are normal. Script-capable files are not. From the WordPress directory, find wp-content/uploads -type f -iname '*.ph*' lists files whose extension starts with ".ph" in any letter case, and find wp-content/uploads -type f \( -iname '*.html' -o -iname '*.htm' -o -iname '*.svg' \) -newermt 2026-01-01 lists HTML and SVG files added this year. Adjust the date to suit your site. Treat any match as something to explain, not as proof of compromise.

Do not delete suspicious files as your first step. Take a backup of files and database, note the file names, paths, and timestamps, and then decide what to remove. If you need a broader method, see how to scan WordPress for malware.

What to do now

Update Depicter to 4.8.2 or later. Use Dashboard, Updates or the Plugins screen, or run wp plugin update depicter with WP-CLI. If you cannot update right away, consider deactivating the plugin until you can, and limit Editor access to people who need it.

After the update:

  • Remove Editor and Administrator roles that are no longer needed, and downgrade accounts that only write content to Author or Contributor.
  • Require unique passwords for editor and administrator accounts, and add two-factor login where you can.
  • Check that your server does not execute scripts from wp-content/uploads. Many hosts block this already; confirm it with your host rather than assuming. The WordPress hardening checklist covers this along with file permissions.

If you find unexpected script files in uploads, unknown editor accounts, or recent uploads no one on your team made, treat the site as possibly compromised. Rotate WordPress, hosting, SFTP, and database credentials as part of the cleanup, once you have removed any access the attacker left behind.

When to get help

Get help if you find files in uploads that nobody can account for, or if an editor account was used in ways your team did not expect. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review user roles, upload handling, and server configuration on a site that looks clean.

Sources