Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15049 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a mal… https://www.cve.org/CVERecord?id=CVE-2026-15049
Post summary
The text discloses that the Depicter plugin (pre‑4.8.0) has a flaw allowing uploads without proper file type validation, potentially enabling malicious file injection.
🚨*CVE* CVE-2026-15049 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a mal… https://www.cve.org/CVERecord?id=CVE-2026-15049 ----- Traducción: CVE-2026-15049 El … https://infoflow.cloud`
Post summary
The post announces CVE-2026-15049, noting a file‑type validation flaw in the Depicter WordPress plugin, but provides no evidence of active exploitation or remediation.
CVE-2026-15049 Remote Code Execution in Depicter WordPress Plugin Before 4.8.0 via Malformed Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15049
Post summary
The post discloses a Remote Code Execution vulnerability (CVE-2026-15049) in Depicter WordPress plugin versions earlier than 4.8.0, triggered by malformed upload handling.