Jupiter X Core: authentication bypass via Twitter/X login (CVE-2026-106013)
A vulnerability, CVE-2026-106013 (CVSS 9.8), was published for the Jupiter X Core WordPress plugin. The verify_twitter_callback function does not assign the visitor's token to the TwitterOAuth client, so the request is signed with the X app owner's token.
Checked in Shield: no
Who is affected
All Jupiter X Core versions up to and including 4.61.0 are affected. An unauthenticated attacker can log in as the WordPress user whose email matches the X app owner, typically the administrator.
How to check
Open the plugin list in the WordPress admin and check the Jupiter X Core version. Version 4.61.0 or lower falls under the description. Also check whether Twitter/X social login is enabled.
How to fix
The source does not name a fixed version. Watch for a plugin update from the vendor and install the patch when released. Until then, consider disabling Twitter/X login.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
A fixed version and any exploitation data are not disclosed yet. Source: NVD, CVE-2026-106013.
