The Jupiter X Core plugin for WordPress allows unauthenticated users to download files using the 'file' parameter in a dedicated download script. While a realpath check confines the reads to the wp-content/uploads/ directory, this still permits exposure of any content stored there, including potentially sensitive user uploads or hidden configuration snippets placed in that folder. The flaw constitutes a directory traversal style issue that enables a remote attacker to read files from inside the uploads directory without any authentication.

The vulnerability affects all versions of the Artbees Jupiter X Core plugin up to and including 4.62.0. Any WordPress site that has this plugin installed and has not been updated beyond that version is potentially exposed. No other product or vendor is listed as affected.

With a CVSS score of 5.3 the risk is characterized as moderate. The exploit is straightforward: a remote, unauthenticated HTTP request to a publicly reachable download endpoint can retrieve any file under wp-content/uploads/. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it has not yet been reported as widely exploited. However, the lack of access control for the download function is a significant deviation from best practice and increases the potential for information disclosure.