CVE-2024-7772
📋 TL;DR
The Jupiter X Core WordPress plugin has a critical vulnerability allowing unauthenticated attackers to upload arbitrary files due to improper file type validation. This can lead to remote code execution on affected WordPress sites. All WordPress sites using Jupiter X Core version 4.6.5 or earlier are vulnerable.
💻 Affected Systems
- Jupiter X Core WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via remote code execution, allowing attackers to install malware, steal data, deface websites, or use the server for further attacks.
Likely Case
Attackers upload web shells to gain persistent access, deface websites, or install cryptocurrency miners.
If Mitigated
File uploads blocked or properly validated, limiting impact to denial of service if upload attempts flood the server.
🎯 Exploit Status
Exploit requires no authentication and minimal technical skill. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.6
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3139412/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Jupiter X Core and click 'Update Now'. 4. Verify version is 4.6.6 or higher.
🔧 Temporary Workarounds
Disable Jupiter X Core Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate jupiterx-core
Restrict File Uploads via .htaccess
linuxBlock PHP file uploads to the uploads directory.
Add to .htaccess in wp-content/uploads: <Files *.php> deny from all </Files>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file upload attempts to Jupiter X Core endpoints.
- Restrict file permissions on wp-content/uploads directory to prevent execution of uploaded files.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Jupiter X Core version. If version is 4.6.5 or lower, you are vulnerable.Check Version:
wp plugin get jupiterx-core --field=versionVerify Fix Applied:
After updating, confirm Jupiter X Core version is 4.6.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=jupiterx_form_upload
- File uploads with unusual extensions in wp-content/uploads
- 404 errors for uploaded PHP files in uploads directory
Network Indicators:
- Unusual outbound connections from WordPress server post-file upload
- HTTP requests to known web shell paths
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND method="POST" AND params.action="jupiterx_form_upload"