Threats tagged 'ghsa-x3pp-g2j7-pf72'

The Jupiter X Core plugin for WordPress up to and including version 4.62.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate and render arbitrary published post types not intended for public viewing, including sensitive Flamingo CF7 submission records with personal data. Exploitation requires a specific widget configuration ('Is Archive Template' enabled) common in Jupiter X sites, and the nonce used for verification is ineffective as an authorization barrier.