Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jupiter Theme | — | Update jupiter theme to version 6.10.2, or a newer patched version | Dec 8, 2025 | May 18, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub