{"id":"CVE-2026-120555","kind":"vulnerability","aliases":["CVE-2026-120555"],"related":[],"title":"Jupiter X Core WordPress plugin: unauthenticated file read via traversal","description":"The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.","summary":"The Jupiter X Core WordPress plugin, in all versions up to and including 4.62.0, accepts a path in its 'file' parameter that is not properly restricted. An unauthenticated attacker can read the contents of files on the server, which may contain sensitive information.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jupiter-x-core","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-above-4.62.0"],"how_to_check":"- Check the installed Jupiter X Core version in the WordPress admin under Plugins, or with `wp plugin get jupiter-x-core --field=version`.\n- Treat any version `4.62.0` or earlier as affected.\n- Confirm the plugin is actually installed and active on the site.","fix":null,"status":"open","published_at":"2026-11-07T03:17:04+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","triaged_at":"2026-11-07T03:48:11+00:00","updated_at":"2026-11-07T03:48:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T03:48:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Jupiter X Core WordPress plugin: unauthenticated file read via traversal","impact":"medium","summary":"The Jupiter X Core WordPress plugin, in all versions up to and including 4.62.0, accepts a path in its 'file' parameter that is not properly restricted. An unauthenticated attacker can read the contents of files on the server, which may contain sensitive information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jupiter-x-core","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous visitors read files inside the uploads directory.","analyst_note":"","how_to_check":"- Check the installed Jupiter X Core version in the WordPress admin under Plugins, or with `wp plugin get jupiter-x-core --field=version`.\n- Treat any version `4.62.0` or earlier as affected.\n- Confirm the plugin is actually installed and active on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-above-4.62.0"],"who_is_affected":"Sites running the Jupiter X Core plugin at version 4.62.0 or earlier are exposed, because the flaw is reachable without logging in. The sources state that reads are confined to wp-content/uploads/, so wp-config.php and files outside that directory are not reachable through this flaw, but files inside uploads are. Sites without this plugin installed, or running a later version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001191,"input_tokens":4308,"output_tokens":1520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120555':13A,16A '-2023':124C '-2026':12A,15A '-3813':125C '/uploads':141C '4.62.0':39B,88C 'accept':40B 'arbitrari':106C 'attack':54B,100C 'cannot':143C 'check':119C 'confin':118C,136C 'contain':66B,113C 'content':58B,104C,140C 'core':3A,20B,29B,72C 'cve':11A,14A,123C 'directori':79C,151C 'file':7A,45B,60B,91C,107C,148C 'fix':126C 'host':24B 'includ':38B,87C 'inform':68B,115C 'introduc':120C 'jupit':1A,18B,27B,70C 'jupiter-x-cor':17B 'make':95C 'may':65B 'outsid':149C 'packag':21B 'paramet':46B,92C,93C 'path':42B,117C 'plugin':5A,31B,73C 'possibl':97C 'present':130C 'proper':50B 'reach':144C 'read':8A,56B,102C,134C 'realpath':128C 'restrict':51B 'self':23B 'self-host':22B 'sensit':67B,114C 'server':63B,110C 'strpos':127C 'travers':10A,80C 'unauthent':6A,53B,99C 'version':34B,83C 'via':9A,89C 'vulner':77C 'wordpress':4A,25B,30B,75C 'work':132C 'wp':139C 'wp-config.php':145C 'wp-content':138C 'x':2A,19B,28B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Jupiter X Core plugin at version 4.62.0 or earlier are exposed, because the flaw is reachable without logging in. The sources state that reads are confined to wp-content/uploads/, so wp-config.php and files outside that directory are not reachable through this flaw, but files inside uploads are. Sites without this plugin installed, or running a later version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jupiterxcore","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120555':13A,16A '-2026':12A,15A 'core':3A 'cve':11A,14A 'file':7A 'jupit':1A 'plugin':5A 'read':8A 'travers':10A 'unauthent':6A 'via':9A 'wordpress':4A 'x':2A","search_b":"'4.62.0':39B 'accept':40B 'attack':54B 'contain':66B 'content':58B 'core':20B,29B 'file':45B,60B 'host':24B 'includ':38B 'inform':68B 'jupit':18B,27B 'jupiter-x-cor':17B 'may':65B 'packag':21B 'paramet':46B 'path':42B 'plugin':31B 'proper':50B 'read':56B 'restrict':51B 'self':23B 'self-host':22B 'sensit':67B 'server':63B 'unauthent':53B 'version':34B 'wordpress':25B,30B 'x':19B,28B","search_c":"'-2023':124C '-3813':125C '/uploads':141C '4.62.0':88C 'arbitrari':106C 'attack':100C 'cannot':143C 'check':119C 'confin':118C,136C 'contain':113C 'content':104C,140C 'core':72C 'cve':123C 'directori':79C,151C 'file':91C,107C,148C 'fix':126C 'includ':87C 'inform':115C 'introduc':120C 'jupit':70C 'make':95C 'outsid':149C 'paramet':92C,93C 'path':117C 'plugin':73C 'possibl':97C 'present':130C 'reach':144C 'read':102C,134C 'realpath':128C 'sensit':114C 'server':110C 'strpos':127C 'travers':80C 'unauthent':99C 'version':83C 'via':89C 'vulner':77C 'wordpress':75C 'work':132C 'wp':139C 'wp-config.php':145C 'wp-content':138C 'x':71C","first_public_at":"2026-11-07T03:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120555","severity":null,"published_at":"2026-11-07T03:17:04+00:00","modified_at":"2026-11-07T03:17:04+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","fetched_at":"2026-11-07T03:45:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}