Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106013— Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

Quick assessment

Affected
artbees Jupiter X Core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Jupiter X Core 插件在所有 4.61.0 及以下版本中，存在通过 Twitter/X 社交登录处理器引发的身份验证绕过漏洞。该漏洞源于 函数：在将访问者的 交换为访问令牌后，该处理器从未调用 方法将返回的凭据重新分配给 TwitterOAuth 客户端。这导致后续的 API 调用仍使用站点管理员存储的访问令牌和访问令牌密钥进行签名，而非正在登录的访问者的令牌。 因此，X API 返回的是 X 应用所有者的个人资料，而非正在登录的访问者。插件随后仅通过匹配该应用所有者的电子邮件地

CVSS 9.8 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106013

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
artbees Jupiter X Core 0 ~ 4.61.0 -

II. Public POCs for CVE-2026-106013

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106013

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-106013 (1)

Vendor Advisories for CVE-2026-106013 (1)

IV. Related Vulnerabilities

Same product: Jupiter X Core
Same vendor: artbees
Same weakness: CWE-287