{"id":"CVE-2026-106013","published":"2026-10-28T02:17:01.303","lastModified":"2026-10-28T02:17:01.303","description":"The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3759312/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/twitter.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad42de2-9ed1-4cf6-a031-22789be4cbe2?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Jupiter X Core WordPress plugin has an authentication bypass in its Twitter/X Social Login flow: after receiving a user's OAuth verifier, the handler fails to update the TwitterOAuth client with the visitor's access token, so it reuses the site owner's stored credentials instead. As a result, the X API returns the site owner's profile, and the plugin authenticates the attacker as the WordPress user matching the owner's email address.","exploitability":"Exploitation is trivial for unauthenticated attackers—no credentials or user interaction are required beyond initiating the Twitter/X login callback with a valid oauth_verifier.","blast_radius":"An attacker can impersonate the site administrator (or any WordPress user whose email matches the X app owner's), gaining full administrative access and compromising confidentiality, integrity, and availability of the site.","remediation":"Upgrade to Jupiter X Core plugin version 4.61.1 or later, where the verify_twitter_callback function correctly calls setOauthToken() with the visitor's returned credentials before invoking account/verify_credentials.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","oauth","wordpress","social-login","cwe-287"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:01:56.538Z"}}