Geo Void

**Name of the Vulnerable Software and Affected Versions** Jupiter X Core plugin for WordPress versions up to, and including, 4.6.5 **Description** The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the `validate` function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. The plugin has over 178,000 sales on ThemeForest, making it a widely used and potentially vulnerable target. **Recommendations** For Jupiter X Core plugin for WordPress versions up to, and including, 4.6.5: Update to a version later than 4.6.5 to fix the vulnerability. As a temporary workaround, consider disabling the `validate` function until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation. Avoid using the file upload feature in the affected API endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Jupiter X Core plugin for WordPress versions up to, and including, 4.7.5 **Description** The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass due to improper authentication via the Social Login widget. This allows unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. The vulnerability can be exploited even if the Social Login element has been disabled, as long as it was previously enabled and used. The plugin has been partially patched in version 4.7.5 and fully patched in version 4.7.8. **Recommendations** For versions up to, and including, 4.7.5, update to version 4.7.8 to fully patch the vulnerability. As a temporary workaround, consider disabling the Social Login widget until a patch is available. Restrict access to the Social Login element to minimize the risk of exploitation.