The Jupiter X Core WordPress plugin contains a Local File Inclusion vulnerability in the get_svg() function that allows authenticated users with Contributor level or higher to include and execute arbitrary files on the server. When an attacker uploads a malicious SVG file and then references it in a post, the included file’s PHP code is executed, enabling full remote code execution. This flaw can be abused to bypass existing access controls, exfiltrate sensitive data, or gain administrative control over the site.

All releases of the Jupiter X Core plugin released by Artbees up to and including version 4.8.7 are affected. No other plugins or products are listed as impacted.

The CVSS score for this issue is 8.8, indicating high severity, while the EPSS score of 1% reflects a low but non-zero probability of exploitation. The vulnerability is not catalogued in the CISA KEV database. The attack vector requires a user with Contributor-level permissions; an attacker can submit an SVG upload containing malicious code, then include the file through a form, achieving remote code execution. Because the flaw relies on a common web development weakness—Local File Inclusion—an attacker only needs to authenticate to a WordPress site using a Contributor role, which is a relatively permissive access level.