Jupiter X Core: Unauthenticated Admin Takeover via X Social Login

Threat Overview

A critical authentication bypass vulnerability in Jupiter X Core (jupiterx-core), the companion plugin powering over 100,000 commercial WordPress sites using the Jupiter X theme, allows unauthenticated visitors to log directly into the site owner’s administrator account.

Tracked as CVE-2026-106013 (CVSS 9.8), the defect affects all versions up to and including 4.61.0. Wherever X (Twitter) social login is enabled, an attacker needs no credentials or exploit payload beyond completing a standard social login flow.

The Breakdown: How the Exploit Works

The flaw resides inside verify_twitter_callback in Jupiter X Core’s Raven social login module. When a visitor initiates a login with X and returns with an oauth_verifier, the plugin exchanges that verifier for the visitor’s access token. However, the handler never calls setOauthToken() to bind those returned visitor credentials to the TwitterOAuth client instance.

Because the client retains the site operator’s stored Access Token and Access Token Secret from initialization, the subsequent account/verify_credentials API request asks X for the profile of the application owner rather than the visitor. The plugin receives the site owner’s email address, matches it to the corresponding WordPress user via wp_set_auth_cookie(), and hands the stranger a live administrator session.

The Operational Risk: What an Attacker Gains

• Zero-Click Admin Session Hijacking: Anyone completing the X login flow is authenticated as the WordPress account matching the X app owner—almost always the primary site administrator.
• Total CMS & Server Compromise: With full administrative privileges, attackers can install malicious plugins, inject PHP backdoors, and mint stealth admin accounts.
• Customer & Financial Data Theft: Attackers gain unrestricted access to WooCommerce customer records, form submissions, and stored API keys.
• Silent Evasion of Security Controls: Because login completes through a legitimate OAuth callback and issues a native auth cookie, firewall blocks never trigger.

Our Take in Plain English

“Imagine a security guard who checks a visitor’s ID at the front door, puts it in his pocket, looks at his own master keycard instead, and waves the stranger straight into the executive vault. That is literally what this plugin code does—it forgets to switch from the site owner’s API token to the visitor’s token, so every stranger who clicks ‘Login with X’ gets logged in as the boss. When your commercial website relies on sprawling theme plugins to handle live identity and session cookies, one missing line of PHP hands over the company. A modern pre-rendered edge architecture eliminates theme runtime code and public admin sessions altogether.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Bundles OAuth identity handlers, session cookie generators, and database lookup logic inside bloated third-party theme plugins.
• Modern Pre-Rendered Edge Architecture: Serves your public website as compiled, zero-runtime static HTML at the edge while delegating customer authentication to dedicated identity providers.

Immediate Action Items for WordPress Operators

1. Patch Immediately: Upgrade Jupiter X Core (jupiterx-core) to version 4.62.0 or higher across all sites.
2. Disable Social Login Handlers: Disable the X/Twitter social login integration inside Jupiter X Raven settings if you cannot patch immediately.
3. Revoke Active Admin Sessions: Log out all active sessions for administrator accounts associated with your X developer credentials.
4. Audit for Unauthorized Changes: Inspect installed plugins, administrator user lists, and theme files for signs of compromise.