Description
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
Published: 2026-01-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

WordPress JupiterX Core plugin allows Object Injection through deserialization of untrusted data. An attacker can create a malicious serialized payload that the plugin processes, which may result in arbitrary code execution on the hosting server. This flaw maps to CWE‑502, a high‑severity weakness that facilitates remote code execution without authentication.

Affected Systems

The vulnerability affects all releases of the JupiterX Core plugin from artbees up to and including version 4.10.1. WordPress sites running any of these versions are potentially exploitable. Versions released after 4.10.1 are not listed as affected, implying a patch may exist.

Risk and Exploitability

The CVSS base score of 8.8 reflects a high severity vulnerability, yet the EPSS of less than 1% indicates a very low degree of real‑world exploitation risk at present. The weakness is not in the CISA KEV catalog. Based on the description, the likely attack vector is an HTTP request transmitting crafted serialized data to an endpoint that processes it.

Generated by OpenCVE AI on April 30, 2026 at 14:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade JupiterX Core to the latest available version to remove the vulnerable unserialize call.
  • If an immediate update is not feasible, disable any plugin functionality or endpoint that accepts serialized input, or remove the plugin entirely.
  • Implement strict validation or sanitization for incoming serialized data, ensuring only trusted sources and formats are processed, thereby preventing injection.

Generated by OpenCVE AI on April 30, 2026 at 14:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 27 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 26 Jan 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Artbees
Artbees jupiter X Core
Wordpress
Wordpress wordpress
Vendors & Products Artbees
Artbees jupiter X Core
Wordpress
Wordpress wordpress

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
Title WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability
Weaknesses CWE-502
References

Subscriptions

Artbees Jupiter X Core
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:15.821Z

Reserved: 2025-06-11T16:08:11.572Z

Link: CVE-2025-50004

cve-icon Vulnrichment

Updated: 2026-01-26T21:59:04.214Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T17:15:56.897

Modified: 2026-04-27T16:16:27.713

Link: CVE-2025-50004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T14:15:40Z

Weaknesses