The Jupiter X Core plugin for WordPress allows PHP Object Injection through the deserialization of input supplied to the 'file' parameter of the 'raven_download_file' function. Attackers can embed a malicious PHAR file that contains arbitrary PHP objects, enabling them to execute code indirectly. However, the plugin itself contains no known Proof‑of‑Concept (POP) chain, so the vulnerability is ineffective unless another plugin or theme on the site already provides a POP chain that the attacker can leverage, which could lead to file deletion, data exposure, or code execution.

All installations of the Jupiter X Core plugin by ArtBees that are running version 4.8.11 or earlier. The issue does not affect later releases that have corrected the deserialization logic.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of 3% reflects a moderately low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the presence of a downloadable form that accepts file uploads; unauthenticated users can trigger the attack if such a form exists, while contributors or higher role users can create the form themselves. Because the plugin lacks an inherent POP chain, the risk is significantly mitigated unless the site also uses a plugin or theme that provides such a chain, which would then allow for destructive or destructive impacts.