CVE-2026-120555 · Package
NO FIX YET
The Jupiter X Core WordPress plugin, in all versions up to and including 4.62.0, accepts a path in its 'file' parameter that is not properly restricted. An unauthenticated attacker can read the contents of files on the server, which may contain sensitive information.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Jupiter X Core plugin at version 4.62.0 or earlier are exposed, because the flaw is reachable without logging in. The sources state that reads are confined to wp-content/uploads/, so wp-config.php and files outside that directory are not reachable through this flaw, but files inside uploads are. Sites without this plugin installed, or running a later version, can skip it.
Not affected if plugin-not-installed, version-above-4.62.0
Who cares jupiter-x-core, self-hosted, wordpress
wp plugin get jupiter-x-core --field=version.4.62.0 or earlier as affected.Unknown from the sources.
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.