CVE-2025-50004CWE-502

WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability

High · published January 22, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

🚨 A sneaky deserialization flaw in JupiterX Core could lead to Object Injection—like letting an uninvited guest rewrite the rules at a party! ⚡ Think of this vulnerability like a restaurant that allows guests to send in their own recipes without checking the kitchen—if the chefs aren’t careful, they could end up cooking something dangerously untrustworthy! An attacker could exploit this flaw to inject malicious objects, potentially compromising the entire application. This could lead to unauthorized actions, data manipulation, or even a full takeover of the system, which is absolutely devastating for your security!

Put simply

Think of this vulnerability like a restaurant that allows guests to send in their own recipes without checking the kitchen—if the chefs aren’t careful, they could end up cooking something dangerously untrustworthy! The vulnerability arises from the deserialization of untrusted data, allowing attackers to manipulate objects in unexpected ways. This means they could execute arbitrary code or alter application behavior, creating significant security risks.

What to do

An attacker could exploit this flaw to inject malicious objects, potentially compromising the entire application. This could lead to unauthorized actions, data manipulation, or even a full takeover of the system, which is absolutely devastating for your security! To remediate this, update JupiterX Core to the latest version that addresses this vulnerability. Additionally, implement strict validation and sanitization of any data being deserialized. Regularly audit your code for similar flaws to ensure ongoing security! You've got this! Follow these steps and you'll be one step closer to securing your application! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 55.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability
    cvelistv5