CVE-2025-11370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11370", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-06T14:00:15.658Z", "datePublished": "2026-01-06T03:21:40.305Z", "dateUpdated": "2026-04-08T17:25:35.656Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:35.656Z"}, "affected": [{"vendor": "averta", "product": "Depicter \u2014 Popup & Slider Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings."}], "title": "Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=cve"}, {"url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/RulesAjaxController.php"}, {"url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/ajax.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428118/depicter/trunk/app/routes/ajax.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Brizzle"}], "timeline": [{"time": "2025-10-07T11:18:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-05T15:17:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T15:01:50.835756Z", "id": "CVE-2025-11370", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T15:02:56.692Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T15:01:50.835756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T15:02:50.248Z"}}], "cna": {"title": "Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates", "credits": [{"lang": "en", "type": "finder", "value": "Brizzle"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "averta", "product": "Depicter \u2014 Popup & Slider Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-07T11:18:32.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-05T15:17:33.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=cve"}, {"url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/RulesAjaxController.php"}, {"url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/ajax.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428118/depicter/trunk/app/routes/ajax.php"}], "descriptions": [{"lang": "en", "value": "The Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-06T03:21:40.305Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11370", "state": "PUBLISHED", "dateUpdated": "2026-01-06T15:02:56.692Z", "dateReserved": "2025-10-06T14:00:15.658Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T03:21:40.305Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Depicter \u2014 Popup & Slider Builder", "vendor": "averta", "versions": [{"lessThanOrEqual": "4.0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings."}, {"lang": "es", "value": "El plugin Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n 'store' de la clase RulesAjaxController en todas las versiones hasta la 4.0.7, inclusive. Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n de visualizaci\u00f3n de los pop-ups."}], "id": "CVE-2025-11370", "lastModified": "2026-06-17T08:30:19.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11370", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T15:01:50.835756Z", "version": "2.0.3"}}]}, "published": "2026-01-06T04:15:51.430", "references": [{"source": "security@wordfence.com", "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/RulesAjaxController.php"}, {"source": "security@wordfence.com", "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/ajax.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3428118/depicter/trunk/app/routes/ajax.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:07:55.592380+00:00", "value": {"mitigation_remediation": ["Update the Depicter plugin to a version newer than 4.0.7 when a fix is released.", "If an upgrade is not immediately possible, disable or remove the AJAX route that handles rule storage by editing the plugin\u2019s routes or adding a capability check that restricts the action to users with appropriate permissions.", "Apply site\u2011wide monitoring for unauthorized changes to pop\u2011up or slider rules and audit configuration files for unexpected modifications."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated configuration modification"}, "threat_synthesis": {"affected_systems": "All installations of the Depicter \u2013 Popup & Slider Builder plugin by Averta with a version of 4.0.7 or earlier are affected. The plugin is a WordPress add\u2011on that manages pop\u2011ups, modals, and sliders.", "description_and_impact": "The vulnerability is a missing capability check in the RulesAjaxController\u2019s store function. The likely attack vector involves an unauthenticated user crafting an AJAX request to this endpoint, enabling the modification of pop\u2011up display settings. The flaw is classified as CWE\u2011862 (Missing Authorization). Based on the description, it is inferred that an attacker could alter which content appears in pop\u2011ups or sliders, potentially defacing a site or redirecting visitors to malicious pages. It does not provide code execution but changes the integrity and content of the website.", "risk_and_exploitability": "The CVSS score is 5.3, indicating a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires unauthenticated access to the WordPress site and the ability to send a crafted AJAX request to the RulesAjaxController\u2019s store endpoint. Based on the description, it is inferred that once it succeeds, the attacker can modify popup display rules, which could be used to display spam or misleading content."}}}}, "created": "2026-01-06T14:16:07.610873+00:00", "updated": "2026-04-22T00:15:03.770360+00:00", "vendors": ["averta", "averta$PRODUCT$depicter_slider", "averta$PRODUCT$slider_and_popup_builder_by_depicter", "wordpress", "wordpress$PRODUCT$wordpress"]}