A critical authentication bypass (CVSS 9.8) in the Twitter/X Social Login handler of the Jupiter X Core WordPress plugin lets unauthenticated attackers log in as the WordPress user whose email matches the site's X application owner, who is typically the site administrator.
What Is It
CVE-2026-106013 is an authentication bypass (CWE-287) in the verify_twitter_callback function of Jupiter X Core by artbees. When a visitor signs in with X, the handler exchanges the visitor's oauth_verifier for an access token. It never calls setOauthToken() to load those returned credentials into the TwitterOAuth client.
Because of that, the next account/verify_credentials API call is still signed with the site operator's stored Access Token and Access Token Secret, not the visitor's token. The X API returns the profile of the X application owner instead of the visitor. The plugin then finds a WordPress account using only that owner's email address and authenticates it with wp_set_auth_cookie().
Why It Matters
- Severity: CVSS 3.1 base score 9.8 (CRITICAL), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - No credentials or user interaction required: The attack works over the network with low complexity.
- Likely admin takeover: The account compromised is the one whose email matches the X app owner. NVD notes this is typically the site administrator, which would give the attacker full control of the site.
- Exploitation status: There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| artbees | Jupiter X Core (WordPress plugin) | All versions up to and including 4.61.0 |
The vulnerable code path is the Twitter/X Social Login handler in the plugin's Raven forms module. NVD lists no CPEs for this record. The NVD status is "Deferred." The CVE was published 2026-10-28.
Patch Status
The supplied data does not name a fixed version. The references include a WordPress plugin repository changeset (3759312) to the Twitter social login handler (twitter.php), which points to a code fix in the plugin trunk. No CISA KEV required action or due date applies, because the CVE has no KEV entry.
Recommended steps for site owners running Jupiter X Core 4.61.0 or earlier:
- Update to a release that contains the fix as soon as one is available. Confirm the version in the Wordfence advisory.
- Until then, consider turning off Twitter/X Social Login.
- Review administrator sessions and accounts for unexpected logins.