CVE-2023-3813

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.

• CWE-22
• CWE-22

• https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.6.9/includes/extensions/raven/includes/utils.php#L451
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425Exploit
• https://plugins.trac.wordpress.org/changeset/3138013/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php
• https://plugins.trac.wordpress.org/changeset/3142669/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cveThird Party Advisory

Published

Jul 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38123Inductive Automation Ignition OPC UA Quick Client Missing Au…8.8
• CVE-2023-38124Inductive Automation Ignition OPC UA Quick Client Task Sched…8.8
• CVE-2023-38125Softing edgeAggregator Permissive Cross-domain Policy with U…8.8
• CVE-2023-38126Softing edgeAggregator Restore Configuration Directory Trave…7.2
• CVE-2023-38127An integer overflow exists in the "HyperLinkFrame" stream pa…7.8
• CVE-2023-38128An out-of-bounds write vulnerability exists in the "HyperLin…7.8
• CVE-2023-38130Cross-site request forgery (CSRF) vulnerability in CubeCart …8.1
• CVE-2023-38131Improper input validationation for some Intel Unison softwar…6.5
• CVE-2023-38132LAN-W451NGR all versions provided by LOGITEC CORPORATION con…8.8
• CVE-2023-38133The issue was addressed with improved checks. This issue is …6.5
• CVE-2023-38135Improper authorization in some Intel(R) PM software may allo…6.7
• CVE-2023-38136The issue was addressed with improved memory handling. This …7.8