WordPress Plugin Vulnerabilities

Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

Description

The plugin does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
depicter
Fixed in 4.8.0

References

CVE
CVE-2026-15049

Miscellaneous

Original Researcher
md. minaruzzaman shovon
Submitter
md. minaruzzaman shovon
Verified
Yes
WPVDB ID
c32e6a11-98f2-48e8-be64-f0c1966ddc18

Timeline

Publicly Published
2026-08-18 (about 2 days ago)
Added
2026-08-18 (about 1 day ago)
Last Updated
2026-08-18 (about 1 day ago)

Other

Published
Title
Published
2025-06-12
Title
WP VR < 8.5.27 - Authenticated (Contributor+) Arbitrary File Upload
Published
2026-05-21
Title
BookingPress Pro < 5.7 - Unauthenticated Arbitrary File Upload via Signature Custom Field
Published
2014-08-01
Title
wp-3dflick-slideshow - Arbitrary File Upload
Published
2024-07-23
Title
Social Auto Poster < 5.3.15 - Authenticated (Contributor+) Arbitrary File Upload
Published
2025-11-17
Title
WP Dropzone < 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload