CVE-2022-1654: Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation
Published Jun 13, 2022
·Updated
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abbuninstalltemplate" (both) and "jupiterxcorecpuninstalltemplate" (JupiterX Core Only) AJAX actions
Affected Software
2 affected components
Artbees Jupiter Wordpress<=6.10.1
Artbees Jupiterx Wordpress<=2.0.7
Event History
Jun 13, 2022
CVE Published
via MITRE·01:16 PM
Data Sourced
via MITRE·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is Jupiter Theme CVE-2022-1654?
Jupiter Theme CVE-2022-1654 allows any authenticated attacker, including subscriber or customer-level ones, to gain administrative privileges via specific AJAX actions.
2
How severe is CVE-2022-1654 vulnerability in Jupiter Theme?
CVE-2022-1654 has a severity rating of 8.8, considered critical.
3
What actions can an attacker perform with CVE-2022-1654 in JupiterX Core Plugin?
An attacker can gain administrative privileges using the "jupiterx_core_cp_uninstall_template" AJAX action in the JupiterX Core Plugin.