CVE-2024-7772 CRITICAL

CVE-2024-7772: Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload

Vendor Artbees
Product Jupiter X Core
Weakness CWE-434 · Unrestricted file upload
Published September 26, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Explanation of Vulnerability in Simple Terms

02Summary

Jupiter X Core versions up to 4.6.5 contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the site without authentication, potentially allowing them to run malicious code. This affects all installations of the affected versions and requires immediate patching.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the site and run malicious code without needing to log in.

Potential impact on your site

04Site Impact

Attackers can take full control of your site, steal data, modify content, or use it to attack visitors.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 26, 2024 CVE published
April 8, 2026 Record updated