Jupiter X Core vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 9.8 (critical)no login neededAffected: older than 4.62.0Fixed in 4.62.0Published 26 October 2026CVE-2026-106013

   Advisory: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0.

2. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 4.14.2Fixed in 4.14.2Published 20 April 2026CVE-2026-39490

   Advisory: Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

3. PHP object injection

   In some setups, someone could make your server run code.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.11.0Fixed in 4.11.0Published 12 January 2026CVE-2025-50004

   Advisory: Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.

4. PHP object injection

   In some setups, someone could make your server run code.

   Score 8.1 (high)no login neededAffected: older than 4.8.12Fixed in 4.8.12Published 25 April 2025CVE-2025-2105

   Advisory: The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file'...

5. Code execution

   Someone could run their own code on your server.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.8.8Fixed in 4.8.8Published 31 January 2025CVE-2025-0366

   Advisory: The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_svg() function.

6. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 9.8 (critical)no login neededAffected: older than 4.7.8Fixed in 4.7.8Published 25 September 2024CVE-2024-7781

   Advisory: The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5.

7. File upload

   Someone could upload files to your server, which can include code.

   Score 9.8 (critical)no login neededAffected: older than 4.6.6Fixed in 4.6.6Published 23 August 2024CVE-2024-7772

   Advisory: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5.

8. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 9.8 (critical)no login neededAffected: older than 3.4.3Fixed in 3.4.3Published 22 August 2023CVE-2023-38389

   Advisory: Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.

9. File upload

   Someone could upload files to your server, which can include code.

   Score 9.0 (critical)no login neededAffected: older than 3.3.8Fixed in 3.3.8Published 22 August 2023CVE-2023-38388

   Advisory: Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.

10. Missing permission check

    An action that should need permission could be done without it.

    Score 8.3 (high)needs only a customer accountAffected: older than 3.3.5Fixed in 3.3.5Published 13 August 2023CVE-2023-38385

    Advisory: Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.

11. File access

    Someone could read files on your server they should never see.

    Score 7.5 (high)no login neededAffected: older than 4.6.9Fixed in 4.6.9Published 20 July 2023CVE-2023-3813

    Advisory: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0.

3 older holes, published before 1 January 2023

1. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.0.8Fixed in 2.0.8Published 18 May 2022CVE-2022-1654

   Advisory: Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both)...

2. File inclusion

   Someone could make the plugin load files it shouldn't, which can expose data or run code.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.0.8Fixed in 2.0.8Published 18 May 2022CVE-2022-1657

   Advisory: Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion.

3. Missing permission check

   An action that should need permission could be done without it.

   Score 7.3 (high)no login neededAffected: older than 2.0.8Fixed in 2.0.8Published 18 May 2022CVE-2022-1659

   Advisory: Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by...

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Jupiter X Core. The version number is under its name. If it is lower than 4.62.0, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/jupiterx-core/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update Jupiter X Core to 4.62.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Jupiter X Core.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use Jupiter X Core, delete it instead of leaving it deactivated.

Questions

Which Jupiter X Core version fixes it?

Version 4.62.0 or newer fixes all 14 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs Jupiter X Core older than 4.62.0. In WordPress, open Plugins and read the version under Jupiter X Core. Without logging in, open yourstore.com/wp-content/plugins/jupiterx-core/readme.txt and read the Stable tag line.

I don't use Jupiter X Core any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.