CVE-2025-11373: Depicter WordPress Plugin Auth Bypass

CVE-2025-11373 Overview

CVE-2025-11373 affects the Popup and Slider Builder by Depicter plugin for WordPress in all versions up to and including 4.0.4. The plugin's depicter-media-upload AJAX route lacks capability checks, allowing authenticated users with Contributor-level access or higher to upload limited file types to the affected server. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Contributor-level accounts can bypass intended access controls and write files to the WordPress uploads directory through an unprotected AJAX endpoint.

Affected Products

Popup and Slider Builder by Depicter WordPress plugin, versions ≤ 4.0.4
WordPress sites permitting Contributor-level registration or higher
Sites using the Depicter media upload AJAX route

Discovery Timeline

2025-11-05 - CVE-2025-11373 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11373

Vulnerability Analysis

The Depicter plugin exposes a depicter-media-upload AJAX action that accepts file uploads. The handler validates a CSRF token but omits a WordPress capability check, meaning any authenticated user session that can obtain the nonce can invoke the upload. WordPress roles from Contributor upward can reach the endpoint even though they should not be permitted to add media independently of editorial workflows.

Because the handler enforces file type restrictions, the impact is limited to uploads of file types the plugin permits. However, unauthorized media uploads can still be used to seed phishing content, host tracking pixels, or stage payloads referenced by other flaws. The issue is tracked as [CWE-862] Missing Authorization.

Root Cause

The root cause is the absence of a current_user_can() capability check inside the AJAX handler for depicter-media-upload. Authorization logic relies only on nonce verification implemented in the CsrfAPIMiddleware, which authenticates request origin but not user privilege. The FileUploaderService proceeds to write the uploaded file without confirming that the invoking user holds upload_files or an equivalent capability.

Attack Vector

An attacker first obtains a Contributor-level account, either through open registration or credential compromise. The attacker then retrieves a valid nonce from an authenticated page and issues a POST request to admin-ajax.php with action=depicter-media-upload and a file payload. Because the endpoint accepts the request without a privilege check, the file is stored in the WordPress uploads directory. Refer to the WordPress Middleware Code Snippet and the WordPress File Uploader Code Snippet for the affected code paths.

// No verified exploit code available. See vendor references for technical details.

Detection Methods for CVE-2025-11373

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=depicter-media-upload from low-privilege user sessions
Unexpected files appearing in wp-content/uploads/ timestamped shortly after Contributor logins
New or dormant Contributor accounts becoming active immediately before upload activity

Detection Strategies

Review web server access logs for admin-ajax.php requests with the depicter-media-upload action and correlate against the requesting user role
Compare installed Depicter plugin versions across sites against version 4.0.4 or earlier using WordPress inventory data
Alert on file writes to wp-content/uploads/ originating from PHP worker processes handling Contributor-authenticated sessions

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to baseline AJAX action usage per role
Monitor Contributor and Author account creation, especially on sites with open registration
Track file integrity of the WordPress uploads directory and flag file types not typically produced by editorial workflows

How to Mitigate CVE-2025-11373

Immediate Actions Required

Update the Depicter plugin to a version later than 4.0.4 that includes the fix referenced in the WordPress Depicter Changeset
Audit existing Contributor, Author, and Editor accounts and remove any that are inactive or unrecognized
Inspect wp-content/uploads/ for files uploaded by low-privilege users during the exposure window

Patch Information

The vendor addressed the missing capability check in the commit tracked by the WordPress Depicter Changeset. Additional advisory details are available in the Wordfence Vulnerability Report.

Workarounds

Disable the Depicter plugin until it can be upgraded past version 4.0.4
Restrict new user registration or set the default role to Subscriber to reduce exposure to authenticated attackers
Deploy a web application firewall rule that blocks unauthenticated or low-privilege requests to admin-ajax.php with action=depicter-media-upload

bash

# Example WordPress CLI check for installed Depicter version
wp plugin get depicter --field=version
wp plugin update depicter