TI-2026-86184 Aliases CVE-2026-120737 GHSA-x3pp-g2j7-pf72

Missing authorization in Jupiter X Core exposes sensitive information

LOW 26CWE-862Published 2026-11-07 · Updated 2026-11-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Jupiter X Core plugin for WordPress, in all versions up to and including 4.62.0, lacks an authorization check. Unauthenticated remote attackers can enumerate and render published post types not meant for public listing, including Flamingo CF7 submission records that contain submitter names, email addresses, phone numbers, messages and IP addresses. Exploitation requires a Posts or Advanced Posts widget with 'Is Archive Template' enabled, and the nonce that protects the second endpoint is printed on every frontend page, so it does not stop attackers.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier.

Why it matters now

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
artbees	Jupiter X Core	up to 4.62.0	—	No fix listed	CNA

Jupiter X Core Vendorartbees Affected up to 4.62.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:artbees:jupiter_x_core::::::::	—	—	artbees

cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:*:*:* Versions — — ·artbees

Remediation

The sources list no fixed version for Jupiter X Core.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

2026-11-07 Threatist record created from CVE-2026-120737
2026-11-07 Alias added: GHSA-x3pp-g2j7-pf72
2026-11-08 Priority changed: MEDIUM → LOW

References

Other 6

TI-2024-07206 Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
TI-2026-81637 Authentication bypass in Jupiter X Core WordPress plugin via X login CVSS 3.1CRITICAL 9.8
TI-2023-19772 WordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-07214 Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
TI-2023-19773 WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability CVSS 3.1CRITICAL 9.8
TI-2025-00298 Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) CVSS 3.1HIGH 8.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences