PT-2024-38569 · WordPress · Jupiter X Core

Geo Void

·

Published

2024-09-25

·

Updated

2024-10-02

·

CVE-2024-7772

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions up to, and including, 4.6.5
Description The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the validate function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. The plugin has over 178,000 sales on ThemeForest, making it a widely used and potentially vulnerable target.
Recommendations For Jupiter X Core plugin for WordPress versions up to, and including, 4.6.5: Update to a version later than 4.6.5 to fix the vulnerability. As a temporary workaround, consider disabling the validate function until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation. Avoid using the file upload feature in the affected API endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-7772

Affected Products

Jupiter X Core