CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38394 – WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-38394
Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. Vulnerabilidad de autorización faltante en Artbees JupiterX Core. Este problema afecta a JupiterX Core: desde 3.0.0 hasta 3.3.0. The JupiterX Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on multiple functions in versions 3.0.0 through 3.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to perform unauthorized actions. • https://patchstack.com/database/vulnerability/jupiterx-core/wordpress-jupiter-x-core-plugin-3-3-0-multiple-subscriber-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-1656 – JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification
https://notcve.org/view.php?id=CVE-2022-1656
Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key. Las versiones vulnerables de JupiterX Theme (versiones anteriores a 2.0.6 incluyéndola) permiten a cualquier usuario con sesión iniciada, incluidos los usuarios con nivel de suscripción, acceder a cualquiera de las funciones registradas en el archivo lib/api/api/ajax.php, que también dan acceso a las acciones jupiterx_api_ajax_ registradas por el plugin JupiterX Core (versiones anteriores a 2.0.6 incluyéndola). Esto incluye la capacidad de desactivar plugins arbitrarios así como actualizar la clave API del tema Vulnerable versions of the JupiterX Theme allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin. This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key. • https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes • CWE-284: Improper Access Control •