CVE-2022-1657

Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function.

• CWE-22

• https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/Exploit, Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1651A memory leak flaw was found in the Linux kernel in acrn_dev…7.1
• CVE-2022-1652Linux Kernel could allow a local attacker to execute arbitra…7.8
• CVE-2022-1653The Social Share Buttons by Supsystic WordPress plugin befor…4.3
• CVE-2022-1654Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 al…8.8
• CVE-2022-1655An Incorrect Permission Assignment for Critical Resource fla…6.5
• CVE-2022-1656Vulnerable versions of the JupiterX Theme (<=2.0.6) allow an…5.4
• CVE-2022-1658Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow a…5.4
• CVE-2022-1659Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin r…7.3
• CVE-2022-1660The affected products are vulnerable of untrusted data due t…9.8
• CVE-2022-1661The affected products are vulnerable to directory traversal,…7.5
• CVE-2022-1662In convert2rhel, there's an ansible playbook named ansible/r…5.5
• CVE-2022-1663The Stop Spam Comments WordPress plugin through 0.2.1.2 does…6.5