A Directory Traversal flaw exists in the inline SVG component of the Jupiter X Core WordPress plugin, allowing authenticated users with Contributor level or higher to read any file on the server. This vulnerability can expose sensitive configuration files, credentials, or other private data, compromising confidentiality of the site’s system and potentially leading to further compromise if secrets are exposed.

The issue affects all installations of Jupiter X Core up to and including version 4.8.7. Sites running WordPress with this plugin and with users assigned the Contributor role or higher are impacted. Newer plugin releases are not vulnerable.

The CVSS score of 6.5 indicates a moderate risk, and the EPSS probability of 1% suggests a low likelihood of exploitation in the wild. While the vulnerability is not listed in CISA’s KEV catalog, it can be abused via authenticated access through the inline‑SVG feature. Attackers must first obtain or elevate a Contributor credential and then instantiate the vulnerable module to traverse directories and retrieve arbitrary files.