Vulnerability in File Upload Handling for Jupiter X Core Plugin by WordPress

CVE-2026-3533

What is CVE-2026-3533?

The Jupiter X Core plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level permissions and above to upload files without proper authorization checks. The import_popup_templates() and upload_files() functions lack sufficient validation for file types, enabling the upload of potentially harmful file formats. This could lead to scenarios where an attacker can execute arbitrary code on servers that are misconfigured to treat .phar files as executable PHP files, or they might exploit stored cross-site scripting (XSS) vulnerabilities through .svg, .dfxp, or .xhtml file uploads across any server setup.

References