{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jupiter-x-core--4.61.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-106013"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jupiter X Core (\u003c= 4.61.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Artbees"],"content_html":"\u003cp\u003eCVE-2026-106013 is an authentication bypass vulnerability in the Jupiter X Core plugin for WordPress (versions up to and including 4.61.0). The vulnerability is located within the \u003ccode\u003everify_twitter_callback\u003c/code\u003e function. During the OAuth callback process, the plugin fails to assign the visitor's obtained OAuth access token to the TwitterOAuth client after a successful token exchange. Consequently, the plugin performs a verification request using the site administrator's pre-configured X application credentials. The API returns the profile of the X application owner, and the plugin incorrectly uses that identity to authenticate a corresponding user within the WordPress site, typically resulting in administrative account takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to gain unauthorized administrative access to the WordPress site. The attacker must target a site that has configured the \u0026quot;Twitter/X Social Login\u0026quot; feature within the Jupiter X Core plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Jupiter X Core plugin to the latest available patched version.\u003c/li\u003e\n\u003cli\u003eIf an update is not immediately feasible, disable the \u0026quot;Twitter/X Social Login\u0026quot; functionality within the plugin settings to mitigate the risk of account takeover.\u003c/li\u003e\n\u003cli\u003eAudit WordPress administrator logs for unexpected login events originating from the Twitter callback URL.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T04:39:36Z","date_published":"2026-10-28T04:39:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jupiter-x-core-auth-bypass/","summary":"The Jupiter X Core WordPress plugin contains an authentication bypass vulnerability (CVE-2026-106013) that allows unauthenticated attackers to hijack administrative accounts by exploiting a flaw in the OAuth callback handling for X (formerly Twitter) social login.","title":"Jupiter X Core: Authentication bypass via Twitter/X Social Login (CVE-2026-106013)","url":"https://feed.craftedsignal.io/briefs/2026-10-jupiter-x-core-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Jupiter X Core (\u003c= 4.61.0)","version":"https://jsonfeed.org/version/1.1"}