Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download (artbees Jupiter X Core)

CVE-2023-3813

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 1.22 % · centile 69 (2026-10-29)
État: PUBLISHED
Publiée: 2023-07-21 02:04 UTC
Mise à jour: 2026-04-08 17:33 UTC
Attribuée par: Wordfence
Statut NVD: Modified

Rechercher sur…

Description

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.

Faiblesses (CWE)

CWE-22 — Traversée de répertoire

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Wordfence
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · security@wordfence.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2023-44446
GCVE · GCVE-0-2023-3813

Configurations affectées (CPE NVD)

cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:wordpress:*:* ≤ 2.5.0

Produits affectés

Produit	Versions
artbees · Jupiter X Core	affected 0 ≤ 4.6.6

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download (artbees Jupiter X Core)