Jupiter X Core: Authentication bypass via Twitter/X social login
Summary
The Jupiter X Core WordPress plugin up to and including 4.61.0 does not assign the visitor's OAuth token to the X API client during Twitter/X social login. The profile lookup therefore returns the X app owner's profile instead of the visitor's. An unauthenticated attacker can log in as the WordPress account whose email matches that owner, typically the site administrator. The risk depends on Twitter/X login being enabled.
Affected
- Jupiter X Core plugin for WordPress, all versions up to and including 4.61.0
- Exposure requires Twitter/X social login to be enabled
Fixed in
Unknown. The vendor has not confirmed a fixed version. One secondary source (VulDB) names 4.61.1 or later.
Workaround
- Disable Twitter/X social login until a fixed version is installed.
Exploitation
- Not known to be exploited.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found.
- EPSS: 0.55 % (early reading, may change).
Our recommendation
- Disable Twitter/X social login now if it is enabled.
- Update Jupiter X Core to a fixed version once the vendor confirms it.
- Review admin logins since 28 Oct 2026 and check whether the email address linked to the X app belongs to a WordPress administrator.
- Rotate admin passwords if any login or email address looks wrong.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WordPress trac changeset 3759312 (Twitter handler) plugins.trac.wordpress.org
- Wordfence threat intelligence record www.wordfence.com
- VulDB CVE-2026-106013 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- The Hacker Wire CVE-2026-106013 www.thehackerwire.com
- WordPress.org plugin listing Jupiter X Core en-gb.wordpress.org
- Artbees change log my.artbees.net
- GitHub tracker CVE-2026-106013 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:23.
Original description (NVD)
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.