External risk intelligence

Jupiter X Core Authentication Bypass via Twitter/X Login

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-106013

The vulnerability exists in a WordPress social login handler, which is a public-facing feature designed for external users to authenticate via third-party services. Because this functionality is intended for public web access and is reachable without authentication, it is highly likely to be exposed on the public internet as part of a standard website deployment.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in the Jupiter X Core plugin for WordPress, affecting its Twitter/X social login feature. This vulnerability allows unauthenticated attackers to bypass security checks and gain administrative access to WordPress sites by impersonating the X application owner. The core issue lies in how the plugin handles authentication tokens, leading to a direct path for unauthorized access.

Unauthenticated attackers can gain admin access.
Affects WordPress sites using X social login.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication in the Jupiter X Core WordPress plugin by manipulating the Twitter/X Social Login process. This allows them to gain administrative access to a WordPress site by impersonating the site owner.

Unauthenticated access to a vulnerable website.
Triggered by initiating a social login with Twitter/X.
Gains administrator privileges on the website.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could gain administrative access to a WordPress site by exploiting a flaw in the Jupiter X Core plugin's Twitter/X social login handler. This occurs when the plugin incorrectly uses the site operator's credentials instead of the user's, leading to authentication as the WordPress user whose email matches the Twitter/X application owner, typically the site administrator.

WordPress administrative access.
Improperly handles social login credentials.
Allows unauthorized site control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Jupiter X Core plugin's authentication bypass vulnerability likely impacts website owners and platform administrators responsible for managing WordPress instances and their associated plugins. The first practical step is to identify all WordPress sites utilizing the Jupiter X Core plugin, assess their exposure, and confirm the accountable owner for each instance before planning remediation.

Website and platform owners should address.
Verify affected WordPress site installations.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Jupiter X Core plugin?

Jupiter X Core is a plugin for WordPress designed to extend the functionality of the Jupiter X theme. It includes various features, such as social login handlers, which allow visitors to sign into a website using external services like Twitter/X rather than creating a separate local account.

How does CVE-2026-106013 enable authentication bypass?

This vulnerability is an Improper Authentication weakness (CWE-287). It occurs because the plugin fails to update its internal credentials after a user initiates a login. Instead of processing the visitor's identity, the system mistakenly uses the stored credentials of the site's Twitter/X application owner, tricking the plugin into logging the attacker into that owner's account.

What triggers this authentication flaw?

The issue is triggered when someone attempts to use the Twitter/X social login feature provided by the plugin. Simply browsing or interacting with other parts of the website does not trigger the bug; the vulnerability is only activated during the specific callback process intended to verify a user's social media credentials.

Is my website at risk from this CVE?

If you use the Jupiter X Core plugin, your site is potentially at risk. Halo Surface Signal indicates that because social login features are intentionally designed for public interaction, they are almost always exposed on the internet. Any site using this plugin's social login capability should consider itself reachable by unauthorized users.

How should I respond to this vulnerability?

Your first step is to inventory all WordPress installations you manage to see if they utilize the Jupiter X Core plugin. Once identified, confirm which sites have the Twitter/X social login feature enabled. Prioritize these instances for updates or temporary disabling of the affected social login functionality until you can apply the necessary vendor patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.