CVE-2026-18961
Received Received - Intake

Authentication Bypass via Unverified Email in VentraConnect WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Wordfence

Description
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-18961
EUVD
EUVD-2026-57065

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ventraconnect social_login to 1.4.3 (inc)
ventraconnect ventraconnect_social_login to 1.4.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the VentraConnect Social Login WordPress plugin up to version 1.4.3. It allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by exploiting Spotify's OAuth flow. The plugin trusts an unverified email field from Spotify's API without checking if the email is verified, enabling attackers to supply a known target email and gain full administrative access.

Impact Analysis

An attacker could gain full administrative control of your WordPress site, allowing them to modify content, install malicious plugins, steal data, or take over the entire site. Even non-admin users could have their accounts compromised, leading to unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized processing of personal data, and failure to maintain confidentiality and integrity of sensitive information.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart