CVE-2026-106013

Summary

The Jupiter X Core WordPress plugin has an authentication bypass in its Twitter/X Social Login flow: after receiving a user's OAuth verifier, the handler fails to update the TwitterOAuth client with the visitor's access token, so it reuses the site owner's stored credentials instead. As a result, the X API returns the site owner's profile, and the plugin authenticates the attacker as the WordPress user matching the owner's email address.

Exploitability

Exploitation is trivial for unauthenticated attackers—no credentials or user interaction are required beyond initiating the Twitter/X login callback with a valid oauth_verifier.

Blast radius

An attacker can impersonate the site administrator (or any WordPress user whose email matches the X app owner's), gaining full administrative access and compromising confidentiality, integrity, and availability of the site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Jupiter X Core plugin version 4.61.1 or later, where the verify_twitter_callback function correctly calls setOauthToken() with the visitor's returned credentials before invoking account/verify_credentials.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.