CVE-2026-3533 File upload in Jupiter X Core
Authenticated subscribers can upload malicious files leading to remote code execution or stored XSS due to missing authorization and insufficient validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3533?
CVE-2026-3533 is a high-severity vulnerability in artbees Jupiter X Core, published on 23 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration
Weakness: CWE-434
Which versions are affected by CVE-2026-3533?
How do I fix CVE-2026-3533?
No fix has been published for CVE-2026-3533 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3533 being exploited?
There is no known exploitation of CVE-2026-3533 in the wild and no public exploit code.
Sources
Also known as GHSA-wv9g-vw7m-7mq8.