CVE-2026-18961

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

• CWE-287

• https://developer.spotify.com/documentation/web-api/reference/get-current-users-profile
• https://plugins.svn.wordpress.org/ventraconnect-social-login/tags/1.4.3/includes/class-oauth.php
• https://plugins.svn.wordpress.org/ventraconnect-social-login/tags/1.4.3/includes/class-user-links.php
• https://plugins.svn.wordpress.org/ventraconnect-social-login/tags/1.4.3/includes/providers/class-provider-generic.php
• https://plugins.svn.wordpress.org/ventraconnect-social-login/tags/1.4.3/includes/providers/normalizer.php
• https://plugins.trac.wordpress.org/changeset/3642024/ventraconnect-social-login
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c0f21a-b04c-407e-9e8c-f81a146deaa8?source=cve

Published

Aug 12, 2026

Last Modified

Aug 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18953Improper limitation of a pathname to a restricted directory …8.8
• CVE-2026-18954Incorrect authorization in the aggregation pipeline tool in …5.7
• CVE-2026-18958A vulnerability was detected in imranrisal-dev Student-Manag…7.3
• CVE-2026-18959A flaw has been found in yushine InnoShop up to 0.8.2. Affec…5.4
• CVE-2026-1896A vulnerability has been found in WeKan up to 8.20. Affected…6.3
• CVE-2026-18960The Block User Account WordPress plugin before 2.0.1 does no…5.4
• CVE-2026-18962The WP Photo Album Plus WordPress plugin before 9.2.09.002 d…4.3
• CVE-2026-18967A flaw was found in the SAML broker component of Keycloak, a…8.1
• CVE-2026-18968A security vulnerability has been detected in ttttonyhe OBlo…4.3
• CVE-2026-18969A vulnerability was detected in Rongzhitong Visual Integrate…7.3
• CVE-2026-1897A vulnerability was found in WeKan up to 8.20. Affected by t…5.3
• CVE-2026-18970A flaw has been found in Rongzhitong Visual Integrated Comma…7.3