Read the docs
TI-2026-81637 Aliases CVE-2026-106013GHSA-5x75-7jgc-v7c2

Authentication bypass in Jupiter X Core WordPress plugin via X login

Priority MEDIUM 50CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

The Jupiter X Core plugin for WordPress is affected up to and including 4.61.0. The Twitter/X social login handler never assigns the visitor's returned OAuth credentials to the API client (CWE-287), so the X API returns the profile of the site's X app owner instead of the visitor. The plugin then signs in the WordPress account whose email matches that owner, typically the site administrator, so an unauthenticated remote attacker can gain access as that user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
artbeesJupiter X Coreup to 4.61.0—No fix listedCNA
  • Jupiter X Core Vendorartbees Affected up to 4.61.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:*:*:*——artbees
  • cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:*:*:* Versions — — ·artbees

Remediation

The sources list no fixed version for Jupiter X Core.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-106013
  2. 2026-10-28 Alias added: GHSA-5x75-7jgc-v7c2
  3. 2026-10-29 CISA SSVC decision points changed

References

Other 2

  • TI-2024-07206 Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-19772 WordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-07214 Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2023-19773 WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-00298 Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) CVSS 3.1HIGH 8.8
  • TI-2022-01527 JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences