CVE-2026-120555

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions prior to 4.62.1

Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By manipulating the file parameter, an attacker can read arbitrary files on the server. However, due to existing path confinement checks using strpos and realpath, access is restricted to the wp-content/uploads/ directory, preventing the retrieval of files like wp-config.php.

Recommendations Update the plugin to version 4.62.1 or later. Avoid using the file parameter in the affected plugin until the update is applied.