Threats tagged 'ghsa-5x75-7jgc-v7c2'

The Jupiter X Core plugin for WordPress contains an authentication bypass vulnerability in its Twitter/X social login handler affecting all versions up to and including 4.61.0. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing it to authenticate users based on the site administrator's Twitter credentials rather than the visitor's. This allows unauthenticated attackers to gain authenticated access as the WordPress user linked to the Twitter app owner's email, typically the site administrator.