Authorization Bypass Vulnerability in Jupiter X Core Plugin for WordPress

CVE-2026-120737

What is CVE-2026-120737?

The Jupiter X Core plugin for WordPress suffers from an authorization bypass vulnerability that affects all versions up to and including 4.62.0. The flaw arises from inadequate user authorization checks, allowing unauthenticated attackers to access and enumerate arbitrary published post types that should remain undisclosed. Specifically, this vulnerability can expose sensitive data, such as user names, email addresses, phone numbers, full messages, and IP addresses from Flamingo CF7 submissions. This exploitation requires the presence of a Posts or Advanced Posts widget with 'Is Archive Template' enabled — a common configuration on Jupiter X sites. Furthermore, nonce verification is ineffective as it is generated through wp_create_nonce and publicly displayed on the front end as ravenTools.nonce, presenting a significant security concern.

References