- Security researchers find faults with high difficulty in popular WordPress plugin
- It enabled threat actors to run malicious code external
- A patch was released at the end of January 2025
Jupiter X Core, a popular WordPress plugin with more than 90,000 users around the world, is vulnerable to a high-difficulty error.
WordPress Security scientists Wordfence revealed that it turned out to be vulnerable to a “local file involvement for remote code performance, which is now traced as CVE-2025-0366. It has a severity of 8.8/10 (high) and affects all versions Up to and including 4.8.7.
Jupiter X Core is an accompanying plugin for the Jupiter X WordPress theme, developed by ArtBees. It expands the functionality of the theme by adding advanced features such as custom side building elements, theme adaptation options and improved design controls. Plugin is primarily used by web designers, developers and business owners.
SVG uploads like the problem
“This allows approved attackers with access to contribution institutions and above to include and execute arbitrary files on the server, allowing the performance of any PHP code in these files,” Wordfence explained. “This can be used to bypass access controls, obtain sensitive data or obtain code execution.”
Wordfence describes what a theoretical attack can look like, said an attacker could create a form that allows SVG uploads, upload the file with malicious content and then include the SVG file in a post, to run the code. The process makes RCE “relatively easy”, it added.
The error was only discovered in early January 2025, when ArtBees returned with a patch by the end of the month. That said, if you use Jupiter x Core, make sure you are running at least version 4.8.8.
At the time of the press, the WordPress site shows 46.8% of users running the latest version, which means that more than 47,000 sites are still vulnerable.
Via Infosecurity Magazine
