{"id":"CVE-2026-106013","kind":"vulnerability","aliases":["CVE-2026-106013"],"related":[],"title":"Jupiter X Core WordPress plugin: Twitter login lets anyone sign in as admin","description":"The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.","summary":"The Jupiter X Core WordPress plugin's Twitter/X social login signs visitors in as whichever WordPress account matches the X app owner's email, because the handler keeps using the site's stored X credentials. An unauthenticated attacker can log in as the site administrator.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check the installed Jupiter X Core plugin version in the WordPress admin Plugins screen; versions up to and including `4.61.0` are affected.\n- Check whether the Twitter/X social login feature is enabled in the Jupiter X Core settings.","fix":"- Update the Jupiter X Core plugin to a version later than `4.61.0`; the fixed version is unknown from the sources.\n- Disable the Twitter/X social login until the plugin is updated.\n- Review WordPress administrator accounts for unexpected logins and rotate their passwords.","status":"open","published_at":"2026-10-28T02:17:01+00:00","first_seen_at":"2026-10-28T02:30:29+00:00","triaged_at":"2026-10-28T02:32:03+00:00","updated_at":"2026-10-28T02:32:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T02:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Jupiter X Core plugin to a version later than `4.61.0`; the fixed version is unknown from the sources.\n- Disable the Twitter/X social login until the plugin is updated.\n- Review WordPress administrator accounts for unexpected logins and rotate their passwords.","reach":"internet","title":"Jupiter X Core WordPress plugin: Twitter login lets anyone sign in as admin","impact":"high","summary":"The Jupiter X Core WordPress plugin's Twitter/X social login signs visitors in as whichever WordPress account matches the X app owner's email, because the handler keeps using the site's stored X credentials. An unauthenticated attacker can log in as the site administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker logs in as the site administrator account.","analyst_note":"Confirm the fixed plugin version and whether the Twitter/X login is on by default, from the NVD entry or the vendor changelog.","how_to_check":"- Check the installed Jupiter X Core plugin version in the WordPress admin Plugins screen; versions up to and including `4.61.0` are affected.\n- Check whether the Twitter/X social login feature is enabled in the Jupiter X Core settings.","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed"],"who_is_affected":"Sites running the Jupiter X Core WordPress plugin at version 4.61.0 or earlier with the Twitter/X social login handler active are exposed. The risk is greatest where the site's X app owner email matches an administrator account, which is typical. Sites without the plugin, or with a newer version or the social login disabled, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":3545,"output_tokens":665,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-106013':16A,19A '-2026':15A,18A '4.61.0':98C 'access':118C,149C,152C,212C 'account':44B,192C 'account/verify_credentials':137C 'address':200C 'admin':13A 'administr':72B,230C 'allow':206C 'anyon':9A 'api':138C,166C 'app':48B,223C 'applic':174C 'attack':65B,208C 'auth':204C 'authent':83C,158C,189C,211C 'bypass':84C 'call':123C,139C 'callback':106C 'caus':134C,163C 'client':133C 'cooki':205C 'core':3A,31B,76C 'correspond':219C 'credenti':62B,129C 'cve':14A,17A 'email':51B,199C,218C 'exchang':110C 'exist':101C 'function':107C 'gain':210C 'handler':54B,90C,121C 'host':23B 'includ':97C 'instead':176C 'jupit':1A,29B,74C 'keep':55B 'let':8A 'log':67B 'login':7A,37B,89C 'match':45B,195C 'never':122C 'oauth':114C 'oper':146C 'owner':49B,175C,197C,224C 'packag':20B 'plugin':5A,27B,33B,77C,185C 'profil':170C 'rather':155C 'reassign':126C 'remain':141C 'resolv':187C 'return':128C,168C 'secret':154C 'self':22B 'self-host':21B 'set':203C 'setoauthtoken':124C 'sign':10A,38B,142C,180C 'signing-in':179C 'site':58B,71B,145C,229C 'social':36B,88C 'sole':193C 'store':60B,148C 'subsequ':136C 'token':119C,150C,153C,161C 'twitter':6A,105C 'twitter/x':35B,87C 'twitteroauth':132C 'typic':227C 'unauthent':64B,207C 'use':56B 'user':216C 'verifi':104C,115C 'version':93C 'via':85C,201C 'visitor':39B,112C,159C,182C 'vulner':81C,100C 'whichev':42B 'whose':217C 'within':102C 'wordpress':4A,24B,26B,32B,43B,79C,191C,215C 'wordpress-plugin':25B 'wp':202C 'x':2A,30B,47B,61B,75C,165C,173C,222C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Jupiter X Core WordPress plugin at version 4.61.0 or earlier with the Twitter/X social login handler active are exposed. The risk is greatest where the site's X app owner email matches an administrator account, which is typical. Sites without the plugin, or with a newer version or the social login disabled, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T02:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106013","severity":null,"published_at":"2026-10-28T02:17:01+00:00","modified_at":"2026-10-28T02:17:01+00:00","first_seen_at":"2026-10-28T02:30:29+00:00","fetched_at":"2026-10-28T02:30:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}