CVE-2023-38394 is a medium severity (CVSS 5.4) missing authorization flaw in the JupiterX Core WordPress plugin, versions 3.0.0 through 3.3.0, reachable by Subscriber accounts. Patchstack lists 3.3.5 as the patched version. Update to 3.3.5 or later, and preferably the current release.
What's affected
The affected product is the JupiterX Core plugin for WordPress, versions 3.0.0 through 3.3.0. The weakness is missing authorization. The record is dated 2024-06-19 and scores 5.4, Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L: low impact on integrity and availability, none on confidentiality.
Patchstack's entry lists the same range, says the required privilege is Subscriber, rates its own priority Low, and gives 3.3.5 as the patched version. Its title says multiple flaws, so the single CVE may stand for a group of related handlers. Patchstack also notes that the free and premium versions share a plugin slug, which can cause false positive alerts for free installs.
Weakness class: CWE-862.
How to check if you're exposed
Check the version with WP-CLI.
wp plugin list --name=jupiterx-core --fields=name,version,status,update
The range 3.0.0 through 3.3.0 is affected. Also review whether visitors can self register.
wp option get users_can_register
If this returns 1, anyone can get a Subscriber account.
What to do now
- Find sites that use JupiterX Core and note the version.
- Update to the latest release, and at least to 3.3.5 for this issue.
- Turn off open registration if the site does not need it.
- Review subscriber accounts and delete unfamiliar ones.
- Read the related entries, CVE-2023-38385, CVE-2023-38388 and CVE-2023-38389, which are more serious and need later versions.
Why it matters
Medium scores are easy to defer, and this one looks small on its own. Its value is as part of a group. The same plugin had four records from the same period, and the most serious two need 3.3.8 and 3.4.3. A site that updates only to 3.3.5 fixes this one and leaves the others.
The right habit with a plugin that has several issues is to go straight to the latest release. The weakness is missing authorization, which in practice means a handler that checks a user is logged in but not what they may do. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Missing authorization means the code performs an action for a logged-in user without checking that this user is allowed to do it. In WordPress plugins this often shows up as an AJAX or REST handler that checks the request is authenticated, or a nonce is valid, but never checks the user's capability. Low-privilege accounts such as subscribers and contributors can then reach functions meant for administrators.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Quick check
Is 3.3.5 enough?
It fixes this one per Patchstack, but other JupiterX Core issues need 3.3.8 and 3.4.3. Go to the latest release.
Who can exploit it?
Any logged-in Subscriber, which on sites with open registration means anyone who signs up.
Sources
Last reviewed: 19 October 2026.
