CVE-2026-15049: Depicter WordPress Plugin RCE Vulnerability

CVE-2026-15049 Overview

CVE-2026-15049 affects the Depicter — Popup & Slider Builder WordPress plugin in versions prior to 4.8.0. The plugin fails to validate file types during import operations and does not remove malformed uploads. Authenticated users with editor-level privileges can write arbitrary files, including executable PHP, into web-accessible directories. This weakness is classified as unrestricted file upload [CWE-434] and can lead to remote code execution on the WordPress host.

Critical Impact
An authenticated editor can upload PHP files via the plugin import feature and execute arbitrary code on the underlying web server, achieving full site compromise.

Affected Products

Depicter — Popup & Slider Builder WordPress plugin versions before 4.8.0
WordPress sites where editor-level accounts are provisioned to non-administrator users
Web servers configured to execute PHP files uploaded to plugin directories

Discovery Timeline

2026-08-20 - CVE-2026-15049 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-15049

Vulnerability Analysis

The Depicter plugin exposes an import feature that accepts uploaded files intended to restore popup and slider configurations. The plugin writes the uploaded file to a web-accessible directory before validating its content type or extension. When the parser encounters a malformed payload, the plugin does not remove the residual file, leaving attacker-controlled content on disk.

Because the destination path resides under the WordPress web root, files ending in .php are executed by the web server on subsequent HTTP requests. An attacker with editor-level access can craft an import archive containing a PHP webshell, trigger the import endpoint, and then request the resulting file to gain code execution as the web server user.

Exploitation requires an authenticated session with editor privileges, which limits attack breadth but does not require administrator access. Editor accounts on multi-author WordPress sites, or accounts compromised through credential reuse, are viable initial-access vectors.

Root Cause

The root cause is missing MIME type and extension validation within the import handler, combined with a failure to unlink files rejected during subsequent processing. The plugin trusts the client-supplied file and permits arbitrary extensions to reach a directory served directly by the web server.

Attack Vector

Exploitation occurs over the network against the WordPress wp-admin interface using authenticated editor credentials. The attacker submits a crafted import request that contains a PHP file, then issues a follow-up HTTP GET request to the resulting URL. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-15049

Indicators of Compromise

New .php, .phtml, or .phar files appearing under the Depicter plugin's upload or import directories
WordPress audit log entries showing editor accounts invoking the plugin's import endpoint
Outbound network connections initiated by the PHP-FPM or Apache worker process to attacker-controlled infrastructure following an import event
Web server access logs recording GET requests to files inside wp-content/uploads/depicter/ or similar plugin paths

Detection Strategies

Monitor file integrity on the wp-content tree and alert on creation of executable script files by the web server user
Correlate WordPress authentication events for editor accounts with subsequent file writes to plugin directories
Inspect HTTP request bodies to the Depicter import endpoint for multipart uploads containing PHP tags or non-image magic bytes

Monitoring Recommendations

Enable WordPress activity logging plugins to capture import operations and role-based actions
Forward web server access logs and PHP error logs to a central analytics platform for retrospective hunting
Baseline the contents of plugin upload directories and alert on deviations

How to Mitigate CVE-2026-15049

Immediate Actions Required

Update the Depicter — Popup & Slider Builder plugin to version 4.8.0 or later on all WordPress installations
Audit editor-level accounts and revoke privileges from users who do not require them
Rotate credentials for all editor and administrator accounts if the plugin was in use before patching
Scan wp-content/uploads and plugin directories for unexpected PHP files and remove any that are not part of a known-good baseline

Patch Information

The vendor addressed the issue in Depicter — Popup & Slider Builder version 4.8.0. Site administrators should apply the update through the WordPress plugin manager or by deploying the vendor-supplied package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Depicter plugin until the update to 4.8.0 or later can be applied
Restrict PHP execution within wp-content/uploads using web server configuration to prevent execution of uploaded scripts
Place the WordPress site behind a web application firewall with rules that block requests containing PHP payloads to plugin import endpoints

bash

# Apache: deny PHP execution inside wp-content/uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}