WordPress Plugin Vulnerabilities

Depicter Slider < 4.0.5 - Missing Authorization

Description

The Depicter — Popup & Slider Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.0.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
depicter
Fixed in 4.0.5

References

CVE
CVE-2025-68558
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f61393-fe09-4488-b8d5-12e2be16c1e2

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Edisc1
Verified
No
WPVDB ID
1e226a18-6095-4d3f-8acb-88cff548ed15

Timeline

Publicly Published
2026-01-05 (about 4 months ago)
Added
2026-01-14 (about 4 months ago)
Last Updated
2026-01-14 (about 4 months ago)

Other

Published
Title
Published
2024-03-21
Title
WP Compress – Image Optimizer < 6.11.11 - Missing Authorization to Unauthenticated CDN Modification
Published
2026-02-16
Title
WowRevenue < 2.1.4 - Subscriber+ Arbitrary Plugin Installation/Activation
Published
2025-12-11
Title
Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion
Published
2025-12-12
Title
AnnunciFunebri Impresa < 4.7.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion
Published
2026-04-08
Title
Advanced CF7 DB < 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export