Is CVE-2026-120555 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120555 being exploited in the wild.

How severe is CVE-2026-120555?

Medium severity, with a CVSS score of 5.3, published 7 November 2026.

Which products and versions are affected?

Wordpress Jupiter X Core up to 4.62.0.

Is there a fix for CVE-2026-120555?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120555 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120555?

Check whether you run Wordpress Jupiter X Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120555: Jupiter X Core directory traversal in file parameter

CVE-2026-120555 · Severity: medium · CVSS 5.3 · Published 2026-11-07

The Jupiter X Core plugin for WordPress, used to build and manage website content, contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive files from the uploads directory. While protections prevent access to critical files outside the uploads folder like wp-config.php, an attacker could still extract private user data, unpublished content, or other confidential information stored there.

Vendors: Wordpress.

Quick answers

Is CVE-2026-120555 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120555 being exploited in the wild.
How severe is CVE-2026-120555?: Medium severity, with a CVSS score of 5.3, published 7 November 2026.
Which products and versions are affected?: Wordpress Jupiter X Core up to 4.62.0.
Is there a fix for CVE-2026-120555?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120555 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120555?: Check whether you run Wordpress Jupiter X Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a directory traversal flaw in the 'file' parameter that bypasses inadequate path validation. Although the plugin implements path confinement via strpos and realpath checks that restrict access to wp-content/uploads/, an attacker can still traverse within that directory to access unintended files without authentication. The attack vector is network-based with no authentication or user interaction required.

Affected products

Wordpress Jupiter X Core up to 4.62.0

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.