CVE-2026-120737

Description

The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier.

References

• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/functionality/frontend.php#L236
• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/module.php#L103
• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L56
• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L96
• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/widgets/posts.php#L259