Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-106013 좀 황당한 건인데, WordPress 플러그인에서 인증 없이 관리자 계정을 탈취할 수 있는 취약점이 공개됐습니다. 10월 28일 공개됐고, CVSS 점수는 9.8입니다. Jupiter X Core 플러그인의 X(Twitter) 소셜 로그인 시에 OAuth 토큰을 잘못 처리하는 게 원인입니다. X 계정으로 소셜 로그인하면, 해당 사용자 계정이 아니라 해당 X앱 소유자의 이메일에 해당하는 계정으로 인증됩니다. 경우에 따라서는 관리자 계정도 탈취할 수 있습니다. 수정 버전은 Jupiter X Core 4.62.0입니다. 대체 뭐하는 거임
@not_sacke yeah ,Critical WordPress vulnerability (CVE-2026-106013, CVSS 9.8) in Jupiter X Core ≤4.61.0 allows unauthenticated admin takeover via broken X/Twitter login flow. and recommended to update to 4.62.0 immediately.
CVE-2026-106013 (CRITICAL / 9.8) — The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in... https://nvd.nist.gov/vuln/detail/CVE-2026-106013 #wordpress
🚨 WordPress: unauthenticated auth bypass in Jupiter X Core (CVE-2026-106013), CVSS 3.1 9.8 (CNA) 🔓 X/Twitter social login callback checks the profile with the site owner's token ⚠️ Affected: ≤4.61.0 ✅ Update to 4.62.0 🔗 https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad42de2-9ed1-4cf6-a031-22789be4cbe2 #WordPress #AppSec https://t.co/VrxzezWquT