CVE-2023-38385 is a high severity (CVSS 8.3) missing authorization flaw in the JupiterX Core WordPress plugin, versions 3.0.0 through 3.3.0, reachable by contributor accounts. Patchstack lists 3.3.5 as the patched version, so update the plugin to 3.3.5 or later on every site.
What's affected
The affected product is the JupiterX Core plugin from Artbees for WordPress, versions 3.0.0 through 3.3.0. The weakness is missing authorization, described as exploiting incorrectly configured access control security levels. The record is dated 2024-12-13 and scores 8.3, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.
Patchstack's database lists the same range, notes that the required privilege is Contributor, and lists 3.3.5 as the patched version. Patchstack rates its own priority as Low, even though the CVSS score is 8.3, because it weighs how likely mass exploitation is for WordPress sites. Read both. If you allow open registration or have contributors you do not fully trust, treat it as a higher priority. Patchstack also notes that the plugin uses one slug for free and premium versions, so free installs can get false positive alerts.
Weakness class: CWE-862.
How to check if you're exposed
With WP-CLI, read the installed version and status.
wp plugin list --name=jupiterx-core --fields=name,version,status,update
Or open Plugins in the WordPress admin and read the version beside Jupiter X Core. Anything from 3.0.0 through 3.3.0 is in the affected range, and 3.3.5 or later is the patched release per Patchstack. Then count users with the Contributor role and above.
What to do now
- Find every WordPress site that has JupiterX Core installed and record its version.
- Update the plugin to 3.3.5 or later, and ideally to the latest release, since later issues were fixed in newer versions.
- Review contributor and author accounts and remove any that are not needed.
- Turn off open registration, or set the default role to Subscriber.
- Check recent content and settings changes for edits you did not expect.
Why it matters
Missing authorization is the most common plugin flaw. A handler checks that the request is made by a logged-in user, but does not check the user's capability. Contributors, who are normally allowed only to write drafts, can then reach functions that change site settings or content.
The vector needs a low-privilege account, so the question for each site is who can get one. Sites that allow open sign up are most exposed. Several JupiterX Core issues were reported together, including CVE-2023-38394 for subscriber accounts and the more serious CVE-2023-38388 and CVE-2023-38389, so keep the plugin current. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Missing authorization means the code performs an action for a logged-in user without checking that this user is allowed to do it. In WordPress plugins this often shows up as an AJAX or REST handler that checks the request is authenticated, or a nonce is valid, but never checks the user's capability. Low-privilege accounts such as subscribers and contributors can then reach functions meant for administrators.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Quick check
Why does Patchstack call it low priority at 8.3?
Patchstack weighs likelihood of exploitation on WordPress sites as well as the CVSS score. Use your own exposure, especially open registration, to decide.
What fixes it?
Update to 3.3.5 or later, per Patchstack.
Sources
Last reviewed: 19 October 2026.
