CVE-2023-38389 is a critical severity (CVSS 9.8) incorrect authorization flaw in the JupiterX Core WordPress plugin, through 3.3.8, which Patchstack describes as an unauthenticated account takeover and privilege escalation. Patchstack lists 3.4.3 as the patched version, so update every site now.
What's affected
The affected product is the JupiterX Core plugin for WordPress, in all versions through 3.3.8. The weakness is incorrect authorization, which allows access to functionality that access control lists should constrain. The record is dated 2024-06-21 and scores 9.8, Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so no login and no interaction are needed.
Patchstack's entry lists the vulnerable versions as 3.3.8 and below, requires no authentication, calls the class privilege escalation, and lists 3.4.3 as the patched version. It says a low-privilege user can become an admin and gain full control. It also carries a label that the vulnerability is known to be exploited. The NVD record's KEV flag is false, meaning CISA has not listed it. I could not confirm exploitation from a CISA source, so treat the Patchstack label as a strong reason to patch immediately rather than a settled fact.
Weakness class: CWE-863.
How to check if you're exposed
Check the version with WP-CLI.
wp plugin list --name=jupiterx-core --fields=name,version,status,update
Versions at or below 3.3.8 are affected, and 3.4.3 or later is patched per Patchstack. Then review administrator accounts for users you do not recognise, since the described outcome is a new or elevated administrator.
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Check registration dates against your records.
What to do now
- Update JupiterX Core to 3.4.3 or later on every site, today.
- List administrator accounts and remove any you did not create. Reset passwords for the rest.
- Review recently installed plugins, themes and scheduled tasks for anything unexpected.
- Check access logs for unusual requests to the plugin's endpoints before the update.
- If you find an unknown administrator, treat the site as compromised and restore from a clean backup after patching.
Why it matters
Incorrect authorization means there is a check, but it lets through a request that should be refused. For an account takeover this is especially serious, because the account that is taken may be an administrator, and an administrator on WordPress can install code. That is why the score is 9.8.
Patchstack's guidance is to update, and where that is not possible to ask the host to help. Patchstack also notes that its mitigation rule can block attacks until you update. The practical sequence is to patch first, then verify nothing was changed before the patch, because an attacker who had admin access keeps it after an update. The record's KEV flag is false.
Incorrect authorization means a check exists but is wrong, so a request that should be refused is allowed. It is subtler than a missing check, because code review sees an access check and moves on. Tests that try each action as each role are the most reliable way to catch it.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exploited in the wild?
The NVD record does not list it as a CISA KEV entry. Patchstack's page labels it as known to be exploited, so patch as though it is.
Does updating remove an attacker's access?
No. Review administrator accounts, plugins and scheduled tasks after updating.
Sources
Last reviewed: 19 October 2026.
