{"id":"CVE-2026-120737","published":"2026-11-07T03:17:04.327","lastModified":"2026-11-08T19:17:36.930","description":"The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier.","cvssScore":5.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/functionality/frontend.php#L236","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/module.php#L103","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L56","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L96","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/widgets/posts.php#L259","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32199349-f7ae-4ed3-ae2b-29e80c08c9d2?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}