Directory Traversal Vulnerability in Jupiter X Core Plugin by WordPress

CVE-2026-120555

What is CVE-2026-120555?

The Jupiter X Core plugin for WordPress is susceptible to directory traversal attacks in all versions up to and including 4.62.0, specifically through the 'file' parameter. This vulnerability allows unauthenticated attackers to access and read the contents of arbitrary files on the server. Notably, while the path confinement check implemented in a previous fix restricts the file reads to the 'wp-content/uploads/' directory, it effectively blocks access to crucial files such as wp-config.php, hence limiting the potential exposure of sensitive information.

References