What is the CVSS score of CVE-2026-3533?

CVE-2026-3533 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-3533?

The Jupiter X Core WordPress plugin contains a critical file upload vulnerability that could allow attackers with basic user accounts to execute malicious code or inject attacks directly into your…

How to fix or mitigate CVE-2026-3533?

Within 24 hours: Identify all WordPress installations using Jupiter X Core plugin and document affected systems; disable the plugin's file upload functionality if possible. Within 7 days: Audit recent file uploads in affected systems for suspicious .phar, .svg, .dfxp, and .xhtml files; implement Web Application Firewall rules to block these file types; review user access logs for unauthorized upload attempts. Within 30 days: Develop a plan to migrate away from Jupiter X Core or replace with patched alternative; implement stricter file upload controls and user privilege restrictions; conduct vulnerability assessment of all WordPress plugins.

PHP CVE-2026-3533

EUVD-2026-14650 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-23 Wordfence

GHSA-wv9g-vw7m-7mq8

Apache WordPress PHP File Upload RCE XSS

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 23, 2026 - 23:45 euvd

EUVD-2026-14650

Analysis Generated

Mar 23, 2026 - 23:45 vuln.today

CVE Published

Mar 23, 2026 - 23:25 nvd

HIGH 8.8

DescriptionCVE.org

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration

AnalysisAI

The Jupiter X Core plugin for WordPress contains an unrestricted file upload vulnerability allowing authenticated users with Subscriber-level privileges or higher to upload dangerous file types including .phar, .svg, .dfxp, and .xhtml files. This stems from missing authorization checks in the import_popup_templates() function and insufficient file type validation in the upload_files() function. Successful exploitation leads to Remote Code Execution on Apache servers with mod_php configured to execute .phar files, or Stored Cross-Site Scripting attacks via malicious SVG and other file types on any server configuration.

Technical ContextAI

This vulnerability affects the Jupiter X Core WordPress plugin (CPE: cpe:2.3:a:artbees:jupiter_x_core) and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The root cause involves two distinct weaknesses: the import_popup_templates() function in class-popup.php lacks proper authorization checks before accepting file uploads, and the upload_files() function in the Raven forms module's file.php does not adequately validate file extensions or MIME types. This allows authenticated users to bypass intended access controls and upload files that would normally be restricted. The vulnerability is particularly severe on Apache servers using mod_php where .phar files can be treated as executable PHP code, enabling arbitrary code execution. On other configurations, attackers can upload client-side attack vectors like SVG files containing malicious JavaScript payloads.

RemediationAI

Update Jupiter X Core plugin to version 4.14.2 or later which addresses the authorization and file validation issues. Review the patch changes in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/ to understand the specific security improvements implemented. As immediate mitigation until patching, disable user registration on WordPress sites to prevent unauthorized Subscriber account creation, implement additional Web Application Firewall rules to block uploads of .phar, .svg, .dfxp, and .xhtml file extensions to the affected plugin paths, and review existing file uploads in wp-content directories for suspicious files uploaded by low-privilege users. On Apache servers, consider disabling .phar file execution through .htaccess rules or php.ini configuration (phar.readonly=1) to prevent RCE exploitation. Audit all Subscriber-level and higher user accounts for legitimacy and remove any suspicious or unused accounts.