CVE-2023-51491 is a cross-site request forgery flaw in the Depicter Slider plugin by Averta, rated Medium (5.4). It affects versions up to and including 2.0.6. Update to 2.0.7 or later.
What's affected
The NVD record names Depicter Slider by Averta and lists versions up to and including 2.0.6. Patchstack lists the required privilege as unauthenticated.
| Item | Detail |
|---|---|
| Product | Depicter Slider (WordPress plugin) |
| Affected | versions up to and including 2.0.6 |
| Fixed | 2.0.7 or later |
| CVSS | 5.4 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| Weakness | CWE-352 (Cross-Site Request Forgery) |
| Published | 2024-03-16 |
The record's CISA Known Exploited Vulnerabilities flag is false for this CVE.
How to check if you're exposed
If you manage the site with WP-CLI, list the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update_version | grep depicter
You can also open Plugins in the WordPress dashboard and read the version under the plugin name. Compare it with the affected range above. If you run many sites, export an inventory of plugins and versions from each one and compare them in one pass. The free scanner at gold.safeguard.sh/scan can check a dependency manifest in the browser, and the Gold directory lists known issues by component.
Also check staging copies and sites that were cloned from older backups. Inactive plugins still sit on disk and some of them still expose files, so remove plugins you no longer use rather than only deactivating them.
What to do now
- Update Depicter Slider to 2.0.7 or later. Back up the site first if you have not already.
- Run the update on staging first if the plugin is business critical, then roll it out to production.
- Re-run the WP-CLI check above on every site you manage and confirm no copy remains in the affected range.
- Remove the plugin if you no longer need it, instead of leaving it deactivated.
- Review administrator accounts and recent changes on any site that ran an affected version while exposed to the internet.
Why it matters
The record classifies this as CWE-352 (Cross-Site Request Forgery).
CSRF means the plugin accepts a state changing request without checking that it came from a page the user meant to use. WordPress provides nonces for exactly this purpose. When a handler skips the nonce check, a malicious page can make a logged in administrator's browser send the request for them.
The attacker needs the victim to take an action, such as visiting a link, which is why the vector marks user interaction as required. The impact depends on what the unprotected action does, and the record rates it as limited integrity change. Even so, an administrator session makes any unprotected action more valuable than it looks.
Quick check
Does an attacker need to log in to the site?
No account is needed, but a logged in user, typically an administrator, has to be tricked into loading attacker controlled content. That is the user interaction requirement in the CVSS vector.
How do I know which version is fixed?
Use the version stated under What is affected, and confirm it against the vendor changelog or advisory linked in Sources before you close the ticket.
Sources
- NVD record data for CVE-2023-51491 via Safeguard Gold
- Patchstack advisory (fetched)
Last reviewed: 19 October 2026.
