Authentication Bypass in Jupiter X Core Plugin for WordPress

CVE-2026-106013

What is CVE-2026-106013?

The Jupiter X Core plugin for WordPress is vulnerable to an authentication bypass that exploits the Twitter/X Social Login handler in versions up to 4.61.0. The vulnerability resides in the verify_twitter_callback function, where the oauth_verifier is exchanged for an access token, but the process fails to correctly assign the returned credentials to the TwitterOAuth client. This oversight results in the account/verify_credentials API call being signed with the site operator's stored Access Token and Secret instead of the authenticating visitor’s token. Consequently, attackers can access the account of any WordPress user whose email matches that of the application owner, typically the site administrator, effectively allowing unauthenticated users to gain unauthorized access.

References