Description
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
Published: 2026-08-12
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The VentraConnect Social Login plugin for WordPress allows unauthenticated attackers to bypass authentication by exploiting the lack of email verification in the Spotify OAuth flow. The plugin copies the unverified email field from Spotify’s /v1/me endpoint into its user profile without checking the email_verified flag, then directly uses that email to authenticate the user and issue a persistent cookie. As a result, an attacker who controls the OAuth callback can log in as any existing WordPress user, including administrators, by simply supplying a known email address, thereby gaining full administrative access to the site.

Affected Systems

All installations of the VentraConnect Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login WordPress plugin with version 1.4.3 or earlier are affected. This includes any WordPress site that has the plugin activated and relies on Spotify as an authentication provider.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score is less than 1 %, suggesting a very low probability that attackers are actively exploiting this flaw, and the issue is not listed in the CISA KEV catalog. However, the attack path is straightforward and requires only control of the Spotify OAuth callback, allowing unauthenticated users to impersonate any site user. Without mitigation, attackers could gain administrative privileges and compromise the entire WordPress installation.

Generated by OpenCVE AI on August 12, 2026 at 14:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the VentraConnect Social Login plugin to the latest version that validates the email_verified flag before authenticating users.
  • If upgrading is not immediately possible, disable or remove the plugin until a fix is available.
  • Implement an additional verification step (e.g., email confirmation or two‑factor authentication) before issuing authentication cookies for social login providers.

Generated by OpenCVE AI on August 12, 2026 at 14:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Fahdaslam
Fahdaslam social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect
Wordpress
Wordpress wordpress
Vendors & Products Fahdaslam
Fahdaslam social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect
Wordpress
Wordpress wordpress

Wed, 12 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
Title Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Fahdaslam Social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-12T16:57:28.350Z

Reserved: 2026-08-05T14:41:30.887Z

Link: CVE-2026-18961

cve-icon Vulnrichment

Updated: 2026-08-12T15:06:58.418Z

cve-icon NVD

Status : Deferred

Published: 2026-08-12T03:16:42.807

Modified: 2026-08-12T21:00:52.257

Link: CVE-2026-18961

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:48:53Z

Weaknesses