Slider & Popup Builder by Depicter CVE-2025-2011: Unauthenticated SQL Injection (100,000+ Sites, CVSS 9.3)

If your WordPress site uses Slider & Popup Builder by Depicter to build sliders, carousels, or email-collecting popups, you need to check your plugin version today. A critical flaw tracked as CVE-2025-2011 lets an attacker read your entire database — usernames, password hashes, and secret keys — without logging in, without a password, and without any interaction from you. With the plugin active on more than 60,000 WordPress sites, this is exactly the kind of vulnerability automated bots hunt for at scale.

The good news: the developer has already released a fix. The bad news: if you have not updated, your site is still exposed. Here is what the vulnerability is, how it works, and exactly what to do about it.

CVE Details at a Glance

• CVE ID: CVE-2025-2011
• Plugin: Slider & Popup Builder by Depicter
• Vulnerability type: Unauthenticated SQL Injection (SQLi)
• CVSS score: 9.3 (Critical)
• Affected versions: All versions up to and including 3.6.1
• Patched version: 3.6.2
• Authentication required: None
• Disclosed: May 2025

An “unauthenticated” vulnerability is the most dangerous category, because the attacker does not need an account, a subscription, or any foothold on your site. Anyone on the internet who can reach your homepage can attempt the attack. The CVSS score of 9.3 places it firmly in the critical band, and the vulnerability was verified and cataloged by major security researchers including Wordfence and Patchstack.

How the Vulnerability Works

To understand this flaw, it helps to know what “SQL injection” means. Your WordPress site stores everything — posts, users, settings, passwords — in a database. When the plugin needs data, it sends the database a query, essentially a sentence written in a language called SQL. A safe plugin treats anything a visitor types as plain text and never as part of that sentence. A vulnerable plugin makes the mistake of pasting visitor-supplied input directly into the SQL sentence, which lets an attacker rewrite the query to say whatever they want.

In Depicter’s case, the weakness lives in the plugin’s Leads feature — the part that stores email addresses and other data collected through popups and forms. The code that handles these requests (in a file named LeadsAjaxController.php) reads a parameter called s from the incoming request and drops it into a database query without properly escaping or preparing it first. Because this endpoint is reachable by anyone through WordPress’s AJAX system, an unauthenticated attacker can send a specially crafted s value that appends their own SQL commands onto the plugin’s legitimate query.

Once that door is open, the attacker can instruct the database to hand back information it should never expose. This is a “union-based” injection, meaning the attacker glues an extra query onto the original one and reads the results directly. No special tools or insider knowledge are required — publicly available proof-of-concept code and automated scanners can perform the attack in seconds.

Real-World Impact

A successful SQL injection against your WordPress database is close to a worst-case scenario. Depending on what the attacker chooses to extract, the fallout can include:

• Stolen administrator credentials. The wp_users table holds usernames and hashed passwords. Attackers routinely crack weak or reused password hashes offline, then log in as a legitimate admin.
• Exposed secret keys and session tokens. The database stores authentication secrets and, in some setups, session data that can be abused to hijack logged-in accounts without ever cracking a password.
• Leaked customer and subscriber data. Email addresses collected through Depicter popups, plus any personal data stored elsewhere in the database, can be harvested — a direct privacy breach with potential GDPR and compliance consequences.
• Full site takeover. Once an attacker has admin access, they can install malicious plugins, inject spam or malware, redirect visitors, or use your server to attack others.

Because the attack is unauthenticated and easy to automate, vulnerabilities like this are typically weaponized within days of public disclosure and swept up into mass-scanning botnets. You do not have to be a high-value target; you just have to be running the vulnerable version when a bot knocks on your door.

How to Check If You Are Affected

Confirming your exposure takes about a minute:

1. Log in to your WordPress dashboard and go to Plugins → Installed Plugins.
2. Look for Slider & Popup Builder by Depicter (sometimes listed simply as “Depicter”).
3. Check the version number shown beneath the plugin name.
4. If the version is 3.6.1 or lower, your site is vulnerable and needs to be updated immediately.
5. If you do not see the plugin at all, you are not affected by this specific issue — but it is still worth reviewing your other plugins for pending updates.

If your dashboard already shows an available update for Depicter, that is a strong signal you are running an outdated, potentially vulnerable version.

How to Fix It

The primary fix is simple and free: update the plugin to version 3.6.2 or later.

1. Go to Plugins → Installed Plugins in your WordPress dashboard.
2. Find Slider & Popup Builder by Depicter and click Update Now. If no update appears, click Check for updates or update from Dashboard → Updates.
3. Confirm the version now reads 3.6.2 or higher.
4. Clear any caching plugin or CDN cache so the updated files are served.

Beyond patching, a few hardening steps reduce your risk from this and future vulnerabilities:

• Enable automatic updates for plugins where possible, so critical fixes land without waiting on manual action.
• Run a Web Application Firewall (WAF). A good firewall can block SQL injection payloads before they reach the plugin, buying you time even if a patch is delayed.
• Rotate your secrets if you suspect exposure. If your site ran the vulnerable version while exposed, change all administrator passwords and regenerate your WordPress security keys (the AUTH_KEY and related salts in wp-config.php).
• Review your database and logs for unfamiliar admin accounts, unexpected queries, or suspicious activity around the disclosure date.
• Remove plugins you do not use. Every inactive-but-installed plugin is still attackable code sitting on your server.

The Takeaway

CVE-2025-2011 is a textbook reminder that a single unescaped parameter in a popular plugin can put your entire database within reach of anonymous attackers. The plugin’s developers responded responsibly and shipped a fix in 3.6.2 — but a patch only protects the sites that actually install it. The real defense is a routine: keep plugins updated, minimize the ones you run, put a firewall in front of your site, and treat critical advisories as same-day tasks rather than someday chores. Do those consistently, and vulnerabilities like this one become a notification you act on rather than a breach you recover from.