The Jupiter X Core plugin for WordPress suffers from a missing capability check in the sync_libraries() function in all versions up to and including 4.8.5. This authorization bypass allows any authenticated user with at least Subscriber-level privileges to invoke the sync_libraries() function, potentially syncing libraries without proper permission. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but resulting in limited impact to integrity only.

An attacker with authenticated access at Subscriber level or above can trigger the sync_libraries() function without proper authorization. This may allow unauthorized synchronization of plugin libraries, potentially leading to unauthorized changes or data manipulation within the plugin context. There is no direct confidentiality or availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor plugin updates from the vendor. Avoid granting Subscriber or higher privileges to untrusted users to reduce risk.