Jupiter X Core <= 4.60.0 - Unauthenticated Authentication Bypass via X (Twitter) Social Login
- ID
- WPSEC-2026-1485
- Plugin
- Jupiter X Core (jupiterx-core)
- Affected
- all versions before 4.62.0
- Remediation
- Update to 4.62.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- Jupiter X Core on WPSec AttackSurface
- Fix released
- Published
Description
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the X (Twitter) social login OAuth callback in all versions up to, and including, 4.60.0. This is due to the callback, which runs on every request carrying an 'oauth_verifier' parameter, fetching the signing-in user's identity with the site's own configured X access token instead of the access token obtained for the visitor, never checking that the returned account matches the access token, and not binding the OAuth request token to the browser that started the sign-in flow. This makes it possible for unauthenticated attackers who complete the X sign-in flow with any X account to be logged in as the WordPress user whose email matches the X account behind the site's configured access token, which may be an administrator. The attacker can also log a victim in to that account through a crafted callback URL. Exploitation requires the X social login feature to be configured on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-1485/
- https://plugins.svn.wordpress.org/jupiterx-core/tags/4.62.0/
- https://wordpress.org/plugins/jupiterx-core/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS