CVE-2023-38388 is a critical severity (CVSS 9.0) unrestricted file upload flaw in the JupiterX Core WordPress plugin, through version 3.3.5. It needs no login. Patchstack lists 3.3.8 as the patched version, so update the plugin to 3.3.8 or later and check for unexpected files.
What's affected
The affected product is the JupiterX Core plugin for WordPress, in all versions through 3.3.5. The weakness is unrestricted upload of a file with a dangerous type. The record is dated 2024-03-26 and scores 9.0, Critical, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. No privileges are required, though the complexity is high.
Patchstack's entry for this CVE lists the vulnerable versions as 3.3.5 and below, requires no authentication, and lists 3.3.8 as the patched version. It rates the issue High priority, and says it is the kind of flaw used in mass exploitation campaigns against WordPress sites. It also notes that the plugin shares one slug between the free and premium versions, so some free installs may see a false positive. The related CVE-2023-38389 is fixed later, in 3.4.3, so aim for the current release.
Weakness class: CWE-434.
How to check if you're exposed
Read the plugin version with WP-CLI.
wp plugin list --name=jupiterx-core --fields=name,version,status,update
Anything at or below 3.3.5 is affected, and Patchstack lists 3.3.8 as the first patched release. After updating, look in the uploads directory for files with executable extensions, which should never be there.
find wp-content/uploads -type f ( -name "*.php" -o -name "*.phtml" -o -name "*.phar" )
Any result deserves investigation.
What to do now
- Find every WordPress site that uses JupiterX Core and its version.
- Update to 3.3.8 or later, and preferably to the latest release, which also covers CVE-2023-38389.
- Search the uploads directory for executable files and inspect or remove any you did not put there.
- Block execution of PHP in the uploads directory at the web server.
- If you find unexpected files, treat the site as compromised: rotate credentials and review users and scheduled tasks.
Why it matters
The weakness is a file upload that does not restrict file type properly. If an attacker can upload a script to a place the web server executes, they can usually run code as the web server user. That is why the scope in the vector is Changed and the impact is High across confidentiality, integrity and availability.
The high complexity rating tempers the score, but Patchstack's own reasoning is that upload flaws in popular plugins attract automated scanning. Defence in depth helps: deny script execution in the uploads folder, and keep write permissions tight. The CVE is not on the CISA Known Exploited Vulnerabilities list. Patchstack describes the class as used in mass campaigns but does not say this specific CVE was exploited.
Unrestricted upload of a file with a dangerous type means the application accepts a file and stores it somewhere the web server will execute it, without checking the type properly. If an attacker can place a script on the server, they can often run code with the web server's rights. Safe handling checks type by content and extension against an allow list, renames files and stores them where they cannot be executed.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Patchstack lists 3.3.8 as the patched version, and the related CVE-2023-38389 needs 3.4.3, so go to the latest.
What should I check after updating?
Look for PHP or other executable files in the uploads directory, and review admin users.
Sources
Last reviewed: 19 October 2026.
