PT-2026-27264 · Artbees · Jupiter X Core

Jack Pas · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-3533

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import popup templates() function as well as insufficient file type validation in the upload files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-3533

Affected Products

Jupiter X Core

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3533 · Security Note
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/fields/file.php?rev=3430169#L214 · Note
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/control-panel-2/includes/class-popup.php?rev=3430169#138 · Note
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/ajax-handler.php?rev=3430169#L434 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/70bc5247-525d-4aae-9d66-efd65c9beee3?source=cve · Note