What’s Vulnerable › Vulnerabilities

CVE-2024-7781: Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-26 · updated 2026-06-17
• Weakness: CWE-288

Description

The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been disabled, as long as it was previously enabled and used. The vulnerability was partially patched in version 4.7.5, and fully patched in version 4.7.8.

Affected products

• artbees Jupiter X Core: before 4.7.8 — fixed in 4.7.8

How to fix

Upgrade to a fixed version: artbees Jupiter X Core 4.7.8. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/facebook.php
• https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/google.php
• https://plugins.trac.wordpress.org/changeset/3153667/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/efd279c2-9e95-45bd-9494-fb53a6333c65?source=cve

Get alerted when CVE-2024-7781 or the next vulnerability affects your stack