The Slider & Popup Builder by Depicter plugin for WordPress <= 3.6.1 is vulnerable to unauthenticated SQL injection via the 's' parameter in admin-ajax.php.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/wp/depicter_sqli_cve_2025_2011msf undefined(depicter_sqli_cve_2025_2011) > show actions ...actions...msf undefined(depicter_sqli_cve_2025_2011) > set ACTION < action-name >msf undefined(depicter_sqli_cve_2025_2011) > show options ...show and set options...msf undefined(depicter_sqli_cve_2025_2011) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub