CVE-2022-1654: 
WordPress vulnerability analysis and mitigation

Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 contain a critical privilege escalation vulnerability that allows any authenticated attacker, including subscribers or customers, to gain administrative privileges. The vulnerability is exploitable through the 'abb_uninstall_template' action in both themes and the 'jupiterx_core_cp_uninstall_template' AJAX action in JupiterX Core (CVE Details).

The vulnerability exists in the AJAX actions 'abb_uninstall_template' and 'jupiterx_core_cp_uninstall_template' that can be exploited by authenticated users to elevate their privileges to administrative level. The issue was discovered in May 2022 and affects Jupiter Theme versions up to 6.10.1 and JupiterX Core Plugin versions up to 2.0.7 (CVE Details).

The vulnerability allows any authenticated user, regardless of their privilege level (including subscribers and customers), to gain administrative access to the WordPress site. This could lead to complete site compromise as administrative users have full control over the WordPress installation (CVE Details).

Users should update their Jupiter Theme to a version higher than 6.10.1 and JupiterX Core Plugin to a version higher than 2.0.7 to mitigate this vulnerability (CVE Details).