Medium severity5.3NVD Advisory· Published Nov 7, 2026· Updated Nov 7, 2026
CVE-2026-120555
CVE-2026-120555
Description
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The path confinement check introduced in the CVE-2023-3813 fix (strpos + realpath) is present and working, so reads are confined to wp-content/uploads/ and cannot reach wp-config.php or other files outside that directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=4.62.0
Patches
Vulnerability mechanics
References
6- plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/forms/actions/download.phpnvd
- plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/forms/module.phpnvd
- plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.phpnvd
- plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.phpnvd
- plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/utils.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/4de3b2bc-b1fc-4865-83e9-5f3c76669097nvd
News mentions
0No linked articles in our index yet.