PT-2025-19874 · WordPress · Slider & Popup Builder

Published

2025-05-06

·

Updated

2025-11-29

·

CVE-2025-2011

CVSS v3.1
7.5
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Slider & Popup Builder by Depicter for WordPress versions up to and including 3.6.1
Description The Slider & Popup Builder by Depicter plugin for WordPress is susceptible to a generic SQL Injection issue. This is due to insufficient escaping of user-supplied data and a lack of proper preparation of existing SQL queries via the 
s
parameter. This allows unauthenticated attackers to inject additional SQL queries into existing ones, potentially enabling them to extract sensitive information from the database, including user password hashes. The plugin is installed on over 100,000 websites. The vulnerable component is located at the 
/wp-admin/admin-ajax.php
endpoint, specifically within an AJAX request handler. Attackers can inject arbitrary SQL queries, extract all password hashes from the 
wp users
table, and potentially perform offline brute-force attacks. A proof-of-concept is publicly available.
Recommendations Versions prior to and including 3.6.1 are affected. Update the Slider & Popup Builder by Depicter plugin to a version later than 3.6.1.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-2011

Affected Products

Slider & Popup Builder