CVE-2026-106013

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions prior to 4.61.1

Description An authentication bypass exists in the Twitter/X Social Login handler. The issue occurs within the verify twitter callback() function where the handler fails to call setOauthToken() after exchanging the oauth verifier for an access token. Consequently, the account/verify credentials API call is signed using the site operator's stored Access Token and Access Token Secret instead of the visitor's token. This leads the X API to return the profile of the application owner, which the plugin then uses to authenticate a WordPress account via wp set auth cookie() based on the owner's email address. This allows unauthenticated attackers to gain access to the account associated with the X app owner, typically the site administrator.

Recommendations Update the Jupiter X Core plugin for WordPress to version 4.61.1 or later.