Another serious WordPress plugin vulnerability could put 40,000 sites at risk of attack

• Security researchers find high-severity flaw in popular WordPress plugin
• It allowed threat actors to run malicious code remotely
• A patch was released in late January 2025

Jupiter X Core, a popular WordPress plugin with more than 90,000 users worldwide, is vulnerable to a high-severity flaw that allows threat actors to run arbitrary files on the server, essentially giving them the ability to fully take over target websites, experts have warned.

WordPress security researchers Wordfence revealed it was found to be vulnerable to a “Local File Inclusion to Remote Code Execution” flaw, now tracked as CVE-2025-0366. It has a severity score of 8.8/10 (high) and affects all versions up to, and including 4.8.7.