PHP Object Injection Vulnerability in Jupiter X Core Plugin for WordPress

CVE-2025-2105

What is CVE-2025-2105?

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection due to unsafe deserialization of untrusted input via the 'file' parameter in the 'raven_download_file' function. This weakness allows attackers to potentially inject malicious PHP Objects through a PHAR file if specific conditions are met. While the vulnerable software lacks a known PHP Object Pollution (POP) chain, the risk increases if other plugins or themes with a POP chain are present. Attackers may exploit this vulnerability if a downloadable file form is available on the site, making it particularly concerning for sites allowing file uploads. Alternatively, contributors and higher user roles can create the necessary forms for exploitation.

References