WordPress Plugin Vulnerabilities

Jupiter X Core < 4.8.6 - Missing Authorization to Authenticated Library Sync

Description

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries

Affects Plugins

Plugin icon
jupiterx-core
Fixed in 4.8.6

References

CVE
CVE-2024-12033
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e452aa0-bfb9-4805-b2ed-53464a4b5308

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Tieu Pham Trong Nhan
Verified
No
WPVDB ID
54a6b671-806c-450f-803a-e86ef9359b16

Timeline

Publicly Published
2025-01-06 (about 1 year ago)
Added
2025-01-06 (about 1 year ago)
Last Updated
2025-01-07 (about 1 year ago)

Other

Published
Title
Published
2023-05-09
Title
SALERT < 1.2.2 - Subscriber+ Missing Authorization
Published
2025-05-19
Title
Bot for Telegram on WooCommerce < 1.2.7 - Missing Authorization
Published
2025-09-26
Title
WP Subscription Forms PRO <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Published
2026-03-10
Title
MC4WP: Mailchimp for WordPress < 4.12.0 - Unauthenticated Arbitrary Subscription Deletion
Published
2025-01-08
Title
SKT Page Builder < 4.8 - Authenticated (Subscriber+) Arbitrary File Upload