CVE-2026-106013: Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-29
Weakness: CWE-287

Description

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.

Summary

Jupiter X Core for WordPress (all versions up to and including 4.61.0) contains an unauthenticated authentication bypass in its Twitter/X Social Login handler. Because verify_twitter_callback never calls setOauthToken() after exchanging the visitor's oauth_verifier, the credentials check runs with the site operator's stored tokens and returns the X app owner's profile, so an attacker can be logged in as the WordPress user matching that email, typically the administrator. CVSS is 9.8 critical; it is not listed in CISA KEV and no in-the-wild exploitation is reported in the provided facts. Update Jupiter X Core to a version later than 4.61.0 once available, and in the meantime disable the Twitter/X social login feature or restrict the plugin until patched.

تحتوي إضافة Jupiter X Core لـ WordPress (جميع الإصدارات حتى 4.61.0 включительно) على ثغرة تجاوز مصادقة غير مصادَق عليها في معالج تسجيل الدخول عبر Twitter/X. ولأن الدالة verify_twitter_callback لا تستدعي setOauthToken() بعد تبادل oauth_verifier الخاص بالزائر، فإن التحقق من بيانات الاعتماد يجري باستخدام رموز مشغّل الموقع المخزّنة ويعيد ملف تعريف مالك تطبيق X، ما يتيح للمهاجم تسجيل الدخول بحساب WordPress المطابق لذلك البريد، وهو عادةً المدير. درجة الخطورة 9.8 (حرجة)، ولا ترد الثغرة في CISA KEV ولم يُذكر استغلال فعلي في المعطيات المتاحة. يُنصح بالترقية إلى إصدار أحدث من 4.61.0 فور توفره، وإلى حين ذلك تعطيل ميزة تسجيل الدخول عبر Twitter/X أو تقييد الإضافة.

Affected products

artbees Jupiter X Core: through 4.61.0

References

Get alerted when CVE-2026-106013 or the next vulnerability affects your stack