CVE-2026-120555
Deferred Deferred - Pending Action

Directory Traversal in Jupiter X Core WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-120555
EUVD
EUVD-2026-118560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
artbees Jupiter X Core From 0 (inc) to 4.62.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Jupiter X Core WordPress plugin up to version 4.62.0 has a Directory Traversal vulnerability via the 'file' parameter. This allows unauthenticated attackers to read arbitrary files on the server, but only within the wp-content/uploads/ directory due to a path confinement check introduced in a previous fix.

Detection Guidance

Check WordPress installations for the Jupiter X Core plugin versions up to 4.62.0. Look for unusual file access patterns in wp-content/uploads/ directories. Review server logs for requests containing the 'file' parameter with path traversal attempts like '../'.

Impact Analysis

Attackers could access sensitive files in the wp-content/uploads/ directory, potentially exposing confidential data like user uploads, configuration details, or other stored files. This could lead to data breaches or further exploitation of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update the Jupiter X Core plugin to the latest version beyond 4.62.0 immediately. If an update is unavailable, disable the plugin temporarily. Restrict access to wp-content/uploads/ directories and monitor for unauthorized file reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...