Jupiter X Core: Unauthenticated Limited File Download via 'file' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Jupiter X Core plugin for WordPress is affected in all versions up to and including 4.62.0. The flaw is a directory traversal through the 'file' parameter, mapped to CWE-862 Missing Authorization, and it lets unauthenticated attackers read arbitrary files on the server, which may contain sensitive information. CVSS 3.1 scores it 5.3 (MEDIUM). The path check added for CVE-2023-3813 (strpos and realpath) works, so reads stay within wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
No fixed version is listed for Jupiter X Core up to and including 4.62.0. Check the vendor, artbees, for a release later than 4.62.0 and update to it once it is available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-120555
- 2026-11-07 Alias added: GHSA-p3jv-9gww-63p2
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4de3b2bc-b1fc-4865-83e9-5f3c76669097?source=cve
- https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.php#L578
- https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.php#L505
- https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.php#L509
- https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/forms/module.php#L33
- https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/forms/actions/download.php#L200
More artbees vulnerabilities
- TI-2024-07206 Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2026-81637 Authentication bypass in Jupiter X Core WordPress plugin via X login CVSS 3.1CRITICAL 9.8
- TI-2023-19772 WordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-07214 Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2023-19773 WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-00298 Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) CVSS 3.1HIGH 8.8
Sources
- CVE-2026-120555 · CVE Program
- CVE-2026-120555 · NVD
- FIRST EPSS
- GHSA-p3jv-9gww-63p2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences