Jupiter X Core: Authentication bypass via Twitter/X Social Login (CVE-2026-106013)

CVE-2026-106013 is an authentication bypass vulnerability in the Jupiter X Core plugin for WordPress (versions up to and including 4.61.0). The vulnerability is located within the verify_twitter_callback function. During the OAuth callback process, the plugin fails to assign the visitor's obtained OAuth access token to the TwitterOAuth client after a successful token exchange. Consequently, the plugin performs a verification request using the site administrator's pre-configured X application credentials. The API returns the profile of the X application owner, and the plugin incorrectly uses that identity to authenticate a corresponding user within the WordPress site, typically resulting in administrative account takeover.

Impact

Successful exploitation allows an unauthenticated attacker to gain unauthorized administrative access to the WordPress site. The attacker must target a site that has configured the "Twitter/X Social Login" feature within the Jupiter X Core plugin.

Recommendation

• Immediately update the Jupiter X Core plugin to the latest available patched version.
• If an update is not immediately feasible, disable the "Twitter/X Social Login" functionality within the plugin settings to mitigate the risk of account takeover.
• Audit WordPress administrator logs for unexpected login events originating from the Twitter callback URL.