Jupiter X Core Flaw Lets Attackers Log In as a Site's Admin Through X Login: Update to 4.62.0

TL;DR: Jupiter X Core, the companion plugin for the Jupiter X WordPress theme by Artbees, has a critical flaw (CVE-2026-106013, CVSS 9.8) that can let an attacker log in as a site’s administrator through the plugin’s X (Twitter) social login, without a password. Versions 4.61.0 and earlier are affected, and Wordfence says 4.62.0 fixes it. If your site runs Jupiter X, update the plugin now.

What happened

On October 27, 2026, Wordfence published an advisory for CVE-2026-106013 in Jupiter X Core, credited to the researcher daroo. Wordfence rates it 9.8 out of 10 and says it needs no login. NVD received the record on October 28 at 10:17 a.m. Manila time.

According to Wordfence, the plugin’s X social login handler never attaches the visitor’s sign-in token before asking X who signed in. X then answers with the profile of the account that owns the site’s X app, and the plugin logs the visitor in as the WordPress user with the matching email address, which is usually the site’s administrator. An attacker who takes over the admin account can install plugins, add users and change any page.

Wordfence lists 4.62.0 as the patched version. Artbees published 4.62.0 on WordPress.org on October 22, 2026; its changelog says “Fixed Security issue” and “Fixed Warnings related to Social Login widget.” WordPress.org shows more than 70,000 active installs.

Wordfence also lists a lower-severity flaw in the same versions, CVE-2026-10511 (CVSS 6.4): stored cross-site scripting through the forgot-password link setting, which needs an account with Contributor access or higher. Wordfence lists 4.62.0 as the fix.

Why it matters

Jupiter X is a popular theme for small business and agency sites, and many of them are set up once and rarely updated. A flaw that hands over the admin account is about as bad as a WordPress bug gets: once in, an attacker can add spam or malware, steal customer data from forms, or lock you out. Details of the flaw are now public, and attackers often move quickly on WordPress plugin bugs like this one. Wordfence’s description points to sites that offer X login on their Jupiter X login or registration forms as the ones at risk.

What to do now

1. Check your version. In WordPress, go to Plugins and find Jupiter X Core. If an agency or developer looks after the site, ask them.
2. Update to 4.62.0. That’s the version Wordfence lists as the fix. Our advice: take a backup first, then test your login and registration forms.
3. Turn off X login if you can’t update today. Our advice: remove X from your social login options until the update is done.
4. Look for signs of trouble. Our advice: check for admin accounts, plugins or settings changes you don’t recognize. If you find any, reset admin passwords and treat the site as compromised.

If you also run Pie Register Premium for sign-ups, it has its own critical flaw this week: see Pie Register Premium CVE-2026-84999. Keeping PHP itself current matters too: see our PHP security release guide. Our Security hub tracks the rest.

Updates

• Oct 28, 2026, 3:07 p.m. Manila: First published. No attacks are reported; we’ll add a dated note if that changes.

Sources & method

Sources

• Wordfence advisory for CVE-2026-106013 (Wordfence, published Oct 27, updated Oct 28, 2026)
• Wordfence vulnerability list for Jupiter X Core, including CVE-2026-10511 (Wordfence)
• Wordfence advisory for CVE-2026-10511 (Wordfence, published Oct 26, updated Oct 27, 2026)
• NVD record for CVE-2026-106013 (NVD, Oct 28, 2026)
• Jupiter X Core on WordPress.org, version 4.62.0 and changelog (Artbees, Oct 22, 2026)

Method. Checked October 28, 2026, at 1:15 p.m. Manila time (05:15 UTC). The flaw description, affected and patched versions, CVSS score and researcher credit come from Wordfence; the release date, changelog and install count come from WordPress.org; the NVD date comes from the NVD record. We checked CISA’s Known Exploited Vulnerabilities catalog. Steps labelled “our advice” are our own judgment, not Wordfence’s or Artbees’. The thumbnail is the preview image from Artbees’ Jupiter X website. No affiliate links on this page. How we work.