PT-2026-27264 · WordPress · Jupiter X Core

Jack Pas · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-3533

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions through 4.14.1

Description The Jupiter X Core plugin for WordPress is susceptible to limited file uploads because of missing authorization in the import popup templates() function and inadequate file type validation within the upload files() function. This allows attackers with Subscriber-level access or higher to upload potentially dangerous files. Successful exploitation could lead to Remote Code Execution on servers configured to execute .phar files as PHP, or Stored Cross-Site Scripting through the upload of .svg, .dfxp, or .xhtml files.

Recommendations Update Jupiter X Core plugin to a version later than 4.14.1.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-3533

Affected Products

Jupiter X Core

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3533 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/70bc5247-525d-4aae-9d66-efd65c9beee3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/ajax-handler.php?rev=3430169#L434 · Note
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/fields/file.php?rev=3430169#L214 · Note
• https://twitter.com/CveFindCom/status/2036242317166698979 · Twitter Post
• https://twitter.com/CVEarity/status/2036851974868787226 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036241306977259973 · Twitter Post
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/control-panel-2/includes/class-popup.php?rev=3430169#138 · Note