PT-2025-45086 · WordPress+1 · Slider & Popup Builder+1

Rafshanzani Suhada · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-11373

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Popup and Slider Builder by Depicter versions up to and including 4.0.4

Description The Popup and Slider Builder by Depicter plugin for WordPress has a flaw that allows authenticated attackers with Contributor-level access or higher to upload files to the server. This is due to a lack of capability checks in the depicter-media-upload API endpoint. The uploaded files are limited in type.

Recommendations Versions prior to 4.0.4 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11373

Affected Products

Depicter

Slider & Popup Builder

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11373 · Security Note
• https://t.me/CVEtracker/36593 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3384613%40depicter&old=3313042%40depicter&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/141769 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ae23f287-e4bb-4f97-aebe-18b6d7ad4e58?source=cve · Note
• https://plugins.trac.wordpress.org/browser/depicter/tags/4.0.4/app/src/WordPress/FileUploaderService.php#L9 · Note
• https://plugins.trac.wordpress.org/browser/depicter/tags/4.0.4/app/src/Middleware/CsrfAPIMiddleware.php#L51 · Note