---
id: "CVE-2026-120555"
page: "https://infrastack.ai/live/CVE-2026-120555"
kind: "vulnerability"
aliases: ["CVE-2026-120555"]
title: "Jupiter X Core WordPress plugin: unauthenticated file read via traversal"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jupiter-x-core", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-above-4.62.0"]
published_at: "2026-11-07T03:17:04+00:00"
first_seen_at: "2026-11-07T03:45:35+00:00"
updated_at: "2026-11-07T03:48:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120555", "first_seen_at": "2026-11-07T03:45:35+00:00"}]
exploit_sources: []
---

# Jupiter X Core WordPress plugin: unauthenticated file read via traversal

Link for people: https://infrastack.ai/live/CVE-2026-120555 (this .md is for agents)

The Jupiter X Core WordPress plugin, in all versions up to and including 4.62.0, accepts a path in its 'file' parameter that is not properly restricted. An unauthenticated attacker can read the contents of files on the server, which may contain sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jupiter X Core version in the WordPress admin under Plugins, or with `wp plugin get jupiter-x-core --field=version`.
- Treat any version `4.62.0` or earlier as affected.
- Confirm the plugin is actually installed and active on the site.

## Timeline

- 2026-11-07T03:45:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120555

## From the sources

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_