Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the abb_uninstall_template (both) and jupiterx_core_cp_uninstall_template (JupiterX Core Only) AJAX actions
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jupiter | Artbees | * | 6.10.1 (including) |
| Jupiterx | Artbees | * | 2.0.7 (including) |