CVE-2026-15049
HIGH — CVSS 7.2Authenticated (Editor+) Arbitrary File Upload via ZIP Import in Depicter Plugin
Summary
An Arbitrary File Upload vulnerability exists in the WordPress Depicter plugin in versions prior to 4.8.0. The plugin features an import utility that accepts compressed ZIP archives to restore or import slider templates and assets.
Due to insufficient validation of archive contents during the extraction process, authenticated users with Editor-level access can upload and extract arbitrary executable files (such as PHP scripts) into publicly accessible web directories, resulting in possible Remote Code Execution (RCE).
Technical Details
Depicter processes uploaded archive packages through an internal extraction routine without validating each individual file extension against the allowed WordPress media whitelist before writing them to disk.
An attacker holding Editor-level privileges can construct a ZIP file containing executable PHP scripts, trigger the import action, and execute arbitrary code by requesting the extracted PHP file directly.
Attack vector: Authenticated Editor file upload via the Depicter import AJAX endpoint.
Impact
- Arbitrary server-side PHP script execution
- Full compromise of the WordPress environment and underlying file system
- Database credential theft and persistence creation
Remediation
Update Depicter to version 4.8.0 or later. The update incorporates strict file extension verification and MIME-type integrity checks during ZIP unpacking routines.