PT-2026-27264 · WordPress · Jupiter X Core

Jack Pas · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-3533

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions through 4.14.1

Description The Jupiter X Core plugin for WordPress is susceptible to limited file uploads because of missing authorization in the import popup templates() function and inadequate file type validation within the upload files() function. This allows attackers with Subscriber-level access or higher to upload potentially dangerous files. Successful exploitation could lead to Remote Code Execution on servers configured to execute .phar files as PHP, or Stored Cross-Site Scripting through the upload of .svg, .dfxp, or .xhtml files.

Recommendations Update Jupiter X Core plugin to a version later than 4.14.1.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-3533

Produtos afetados

Jupiter X Core

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/70bc5247-525d-4aae-9d66-efd65c9beee3?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/ajax-handler.php?rev=3430169#L434 · Nota
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/fields/file.php?rev=3430169#L214 · Nota
• https://twitter.com/CveFindCom/status/2036242317166698979 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3533 · Nota de Segurança
• https://twitter.com/CVEarity/status/2036851974868787226 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2036241306977259973 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/control-panel-2/includes/class-popup.php?rev=3430169#138 · Nota