CVE-2026-106013: Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verifytwittercallback function because after exchanging the visitor's oauthverifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verifycredentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wpsetauthcookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using Jupiter X Core version 4.61.0 or earlier are affected where the Twitter/X Social Login handler is available. The vulnerable flow can authenticate an attacker as the WordPress account whose email matches the X application owner, which is typically an administrator account.
What does an attacker need to exploit it?
An attacker does not need a WordPress account, privileges, or user interaction. Exploitation occurs through the Twitter/X Social Login callback flow using the oauth_verifier parameter.
How can I determine whether a site may already be affected?
Review whether Jupiter X Core 4.61.0 or earlier is installed and whether Twitter/X Social Login is configured. Also investigate authentication activity for the WordPress user whose email address corresponds to the configured X application owner, particularly unexpected logins associated with the social-login flow.