A flaw in the WordPress JupiterX Core plugin allows any user, regardless of authentication status, to gain access to administrative functions or sensitive data that should be protected by the plugin. The weakness, identified as CWE‑862, means an attacker can bypass standard access controls to perform privileged actions, potentially compromising the entire site’s integrity and confidentiality.

JupiterX Core versions up to and including 4.14.1 released by artbees are affected. The impact applies to any WordPress installation that has the plugin enabled and has not been updated to at least version 4.14.2.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of < 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be via anonymous web requests to the plugin’s endpoints, allowing attackers to spoof or elevate privileges without authentication.