Security advisories published last week on the WordPress side show how small mistakes in plugin code can leave a site completely exposed. In two popular plugins, the social login flow is misconfigured: an attacker can log in as an administrator without knowing a password, or even without being a member of the site. Fixed versions have been released for both vulnerabilities, but sites that skip the update remain vulnerable.
In Jupiter X Core, X login verifies the app owner’s account
CVE-2026-106013 affects Jupiter X Core versions 4.61.0 and earlier. The 9.8-rated authentication bypass vulnerability was fixed in version 4.62.0. The problem is in the plugin’s Twitter/X social login handler, in the verify_twitter_callback function: after the visitor’s submitted oauth_verifier value is exchanged for an access token, setOauthToken() is not called.
As a result, the next account/verify_credentials request is signed with the key of the account registered to the site’s X app, not the visitor’s. The X API returns the app owner’s profile, not the visitor’s. The plugin finds the WordPress user matching the returned email address and logs them in with wp_set_auth_cookie(). Because the app owner is usually the site administrator, the result is getting into the admin panel with a single request. The vulnerability was reported by Wordfence researcher daroo.
In Qode Membership, a one-letter typo grants administrator privileges
CVE-2026-92885 affects Qode Membership versions 2.0.6.2 and earlier, distributed with Qode’s Bridge theme. The check in the qode_membership_login_user_from_social_network function that handles Facebook login looks at an undefined variable: the code has $check_social_useqoder, but it should have been $check_social_user.
In PHP, empty() always returns true for an undefined variable, so the branch that validates the token with the Facebook Graph API never runs, and the wp_set_auth_cookie() call remains accessible without any authentication. All an attacker needs is the qode_validate_facebook_login nonce value on the page and an administrator username. Because the nonce is generated on public pages where the [qode_user_login] or [qode_user_register] shortcode is present, no membership is required. The fix was released in version 2.0.6.3.
Two more critical advisories from the same week
In Kirki versions 6.2.5 and earlier (CVE-2026-75891, 8.8), a subscriber-level user can inject data into the get-single-symbol branch of the kirki_post_apis() AJAX router. Because there is no authorization check, PHP object injection becomes possible; using an existing POP chain, the administrator password can be changed. The fix is in version 6.3.0.
In the Checkout Files Upload for WooCommerce plugin (CVE-2026-103688, 9.8), when the accepted file type setting is left empty, the plugin performs no type check at all. An unauthenticated attacker can upload a PHP file and execute code on the server. Version 2.4.0 closes this vulnerability.
What to do
Update Jupiter X Core to 4.62.0, Qode Membership to 2.0.6.3, Kirki to 6.3.0, and Checkout Files Upload for WooCommerce to 2.4.0. Remove any plugins you do not use completely. If you do not use social login, turn it off. Then review the administrator list; if there are accounts created recently, changed passwords, or plugins you do not recognize, assess the possibility that the site has been compromised. Keep two-factor authentication enabled on administrator accounts.
Source: Wordfence Intelligence · WPScan · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.