Jupiter X Core CVE-2026-106013

Exploitation requires that the site has the Jupiter X Core Twitter/X Social Login handler (the Raven forms social-login feature) enabled and configured with the site operator's X application OAuth credentials - this is the specific feature the flaw lives in, not a default state. Given that, the attack is remote and unauthenticated with no user interaction. The account that gets taken over is the WordPress user whose email matches the X application owner's email, which is typically the administrator; if no local account matches that email, impact is limited. The primary limiting factor is therefore the presence and configuration of the X/Twitter social login feature rather than any authentication or interaction barrier.

All severity signals point the same direction: CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a remote, unauthenticated flaw that yields full WordPress account takeover, and the vuln.today decision label is act_now, so this should be treated as a near-term patching priority rather than a high-CVSS-but-low-real-risk issue. The vulnerability is credibly characterized - it was reported by Wordfence and the root cause (the handler never calling setOauthToken(), so verify_credentials stays signed with the operator's token and returns the X app owner's profile, which the plugin then authenticates by email) is specific and consistent with CWE-287. Two signals are missing and should be stated plainly: no EPSS exploitation-probability score is present in the input, and there is no CISA KEV listing, so there is no evidence of active exploitation at this time. No SSVC exploitation/automatable/technical-impact breakdown is provided beyond the act_now label. The one factor that tempers the raw AV:N/PR:N reading is a deployment precondition CVSS does not capture: the Twitter/X social login feature must actually be configured and enabled on the site, so the effective exposed population is narrower than the vector alone implies - but where that feature is enabled, exploitation is a direct unauthenticated takeover of the admin-tier account.

On a site where Jupiter X Core's Twitter/X social login is enabled, an unauthenticated attacker starts the X OAuth sign-in flow; because the plugin verifies credentials using the operator's own stored access token instead of the visitor's, the X API returns the app owner's profile and the plugin logs the attacker in as the WordPress user matching that email - typically the administrator. No user interaction or authentication is required (AV:N/AC:L/PR:N/UI:N). No public exploit code was identified in the provided sources, though the fix is visible in the plugin source changeset.