CVE-2026-120555: Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or other authentication is required.

Q: What files can be exposed?

Reads are confined to the WordPress wp-content/uploads/ directory. Files outside that directory, including wp-config.php, cannot be reached through this issue because the existing realpath-based confinement check is working.

Q: Are sites using the affected plugin affected by default?

The issue affects all Jupiter X Core versions through 4.62.0. Exposure is limited to files present under wp-content/uploads/.

Q: How can I assess potential impact before patching?

Review wp-content/uploads/ for sensitive files that should not be publicly readable, such as backups, exports, uploaded configuration material, or documents containing credentials or personal data. The provided information does not indicate that files outside this directory are exposed.

Published Nov 7, 2026

Updated

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or other authentication is required.

What files can be exposed?

Reads are confined to the WordPress wp-content/uploads/ directory. Files outside that directory, including wp-config.php, cannot be reached through this issue because the existing realpath-based confinement check is working.

Are sites using the affected plugin affected by default?

The issue affects all Jupiter X Core versions through 4.62.0. Exposure is limited to files present under wp-content/uploads/.

How can I assess potential impact before patching?

Review wp-content/uploads/ for sensitive files that should not be publicly readable, such as backups, exports, uploaded configuration material, or documents containing credentials or personal data. The provided information does not indicate that files outside this directory are exposed.

CVE-2026-120555: Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

What files can be exposed?

Are sites using the affected plugin affected by default?

How can I assess potential impact before patching?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What files can be exposed?

Are sites using the affected plugin affected by default?

How can I assess potential impact before patching?