A missing authorization check in the import_popup_templates function and insufficient file type validation in the upload_files function allow an authenticated user with Subscriber-level access or higher to upload files that the WordPress server may treat as executable code. Uploading a .phar file could trigger PHP execution if the server handles .phar files as PHP scripts, while uploading SVG, DFXP, or XHTML files may lead to stored cross‑site scripting. This flaw, identified as CWE‑434, exposes the site to significant confidentiality, integrity, and availability risks.

The vulnerability affects the Jupiter X Core plugin for WordPress, produced by artbees, in all released versions up to and including 4.14.1. No other product or version is currently listed as impacted.

The vulnerability scores a high CVSS of 8.8, indicating considerable severity, and it is not listed in the CISA KEV catalog. Exploitation requires authentication and a Subscriber or higher role; after gaining upload privileges, an attacker can place a malicious file near the web root or in a location served by the server. If the server auto‑executes .phar files or renders .svg/.xhtml files without sanitization, code execution or XSS can be achieved. The attack path is straightforward for anyone with subscriber access who is not already restricted by the site’s configuration.