CVE-2022-1654: Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation
Vulnerability summary
CVE-2022-1654 is a critical (CVSS 9.9) Improper Privilege Management vulnerability in artbees jupiter. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.0.8 and 6.10.2.
Timeline
- 13-06-2022PublishedVulnerability first disclosed.
- 31-01-2025Last modifiedVulnerability information updated.
Description
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.55%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.55% on 27-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Artbees3 products
- jupiter6.10.1 | ≤ 6.10.1
- jupiter x core2.0.7
- jupiterx≤ 2.0.7
Wordpress2 products
- jupiterx-core≤ 2.0.7 (fixed in 2.0.8)
- jupiter≤ 6.10.1 (fixed in 6.10.2)
2 vendors · 5 products