Critical Security Vulnerability in Jupiter X Core Plugin: NITDA Alerts Nigerian Website Owners

The National Information Technology Development Agency (NITDA) has raised concerns for Nigerian website owners regarding a newly discovered security weakness in the Jupiter X Core plugin for WordPress.

The agency disclosed this information via its official X account. Identified as CVE-2025-0366, this vulnerability presents a major cybersecurity threat, potentially granting attackers unauthorized control over affected websites.

According to the agency, the Computer Emergency Readiness and Response Team Nigeria (CERNT.NG) highlighted that the flaw is an “unauthenticated privilege escalation vulnerability,” enabling attackers to obtain administrative privileges or execute arbitrary code on compromised websites.

“A critical security flaw has been discovered in the Jupiter X Core plugin for WordPress, affecting websites using this popular theme framework,” the statement read.

Potential Impact on Nigerian Websites

If exploited, this security loophole can have severe consequences, allowing attackers to:

• Modify or delete website content
• Inject malicious software that could compromise site visitors
• Steal confidential data, including customer information and login credentials
• Redirect users to fraudulent or phishing sites

Recommended Security Measures

To mitigate the risks associated with this vulnerability, CERNT.NG has outlined four essential steps for website administrators and business owners:

1. Upgrade to the latest version
   The issue has been addressed in the patched release, Jupiter X Core 4.8.8. Website owners should check their WordPress dashboard and install the update promptly.
2. Remove outdated or unused plugins
   Unused and obsolete plugins pose security threats, as attackers often exploit known vulnerabilities. Administrators should conduct a plugin audit and uninstall any that are unnecessary.
3. Monitor for unauthorized activity
   Regularly reviewing admin accounts and site settings is crucial. If unfamiliar accounts or unexpected changes are detected, revoke access and reset passwords immediately.
4. Implement strong authentication methods
   Enabling two-factor authentication (2FA) for website administrators and users adds an extra security layer. Additionally, all admin accounts should use robust, unique passwords.