WordPress Plugin Vulnerability Exposes 90,000 Sites to Attack

A critical vulnerability in the Jupiter X Core WordPress plugin, used on over 90,000 websites, has been identified by security researchers.

The flaw, discovered on January 6, allows attackers with contributor privileges or higher to upload malicious SVG files and execute remote code on vulnerable servers. The issue (CVE-2025-0366) has been given a CVSS score of 8.8 (High).

Researchers from Wordfence disclosed that the vulnerability stems from improper sanitization of SVG file uploads and the plugin’s use of the get_svg() function, enabling attackers to bypass security controls.

The flaw allows attackers to upload specially crafted SVG files containing PHP code. By chaining this with a vulnerability in the get_svg() function, malicious files can be executed on the server.

“This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files,” Wordfence wrote.

“This can be used to bypass access controls, obtain sensitive data or achieve code execution.”

Read more on WordPress plugin vulnerabilities: Security Flaws in WordPress Woffice Theme Prompts Urgent Update

The vulnerability was reported by the researcher stealthcopter on January 6 2025, through the Wordfence Bug Bounty Program, earning a $782 bounty.

A patch was released on January 29 2025 by the plugin’s developer, Artbees, that addresses the issue.

“While we do not expect this vulnerability to be widely exploited due to the minimum user-level requirement, vulnerabilities allowing for the upload of .svg files are usually limited to Cross-Site Scripting payloads and don’t typically allow remote code execution via file upload, which makes this vulnerability particularly interesting,” Wordfence explained.

Users of Jupiter X Core are strongly urged to update to version 4.8.8 immediately.

Experts also recommend adopting proactive measures, such as enabling automatic updates for plugins and themes whenever possible, to prevent exploitation. Regularly auditing installed plugins and removing unused or outdated ones can also reduce the attack surface.