CVE-2026-18961 in Social Login
Summary
by MITRE • 08/12/2026
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in VentraConnect plugin version 1.4.3 and earlier represents a critical authentication bypass flaw that undermines the security of passwordless login implementations. This issue stems from improper validation of user identity claims within the OAuth authentication flow, specifically when integrating with Spotify as an identity provider. The plugin fails to implement proper email verification checks before accepting user identity assertions, creating a pathway for malicious actors to exploit the system's trust model. The vulnerability affects WordPress sites that utilize passwordless login mechanisms and demonstrates a fundamental flaw in how third-party identity claims are processed and validated within the application's authentication framework.
The technical implementation of this vulnerability occurs at multiple layers within the plugin's authentication logic. The Generic::normalize_common() function processes data returned by Spotify's /v1/me endpoint without requiring an email_verified assertion from the provider, allowing unverified email addresses to be accepted as legitimate user identifiers. This processed data is then passed through User_Links::link_or_login_user() which directly uses the unverified email address to query WordPress users via get_user_by('email', $email). The absence of any verification gate or challenge mechanism means that an attacker can supply any existing WordPress user's email address during the OAuth flow, and the system will authenticate them as that user without proper validation. This design flaw creates a direct path from unverified third-party claims to authenticated sessions with full user privileges.
The operational impact of this vulnerability is severe and far-reaching for affected WordPress installations. An attacker can gain unauthorized access to any existing WordPress user account, including administrator accounts, by simply knowing the target email address and orchestrating a controlled Spotify OAuth flow. This bypass completely undermines the intended security model of passwordless authentication, where the expectation is that only legitimate users with verified identities should be able to authenticate. The persistent authentication cookie issued via wp_set_auth_cookie() ensures that once an attacker successfully exploits this vulnerability, they maintain access to the compromised account indefinitely until manually revoked. This creates a persistent threat vector that can lead to complete site compromise, data theft, and potential lateral movement within affected networks.
This vulnerability aligns with CWE-287 (Improper Authentication) and represents a specific instance of improper validation of identity assertions in OAuth flows. The attack pattern follows the ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) where attackers leverage valid account information to gain unauthorized access. The implementation violates security best practices for OAuth integration, specifically the principle of least privilege and proper identity verification. Organizations using VentraConnect plugin should immediately implement mitigations including patching to versions 1.4.4 or later, implementing additional email verification steps before user authentication, and considering the removal of untrusted identity providers until proper verification mechanisms are implemented. The vulnerability also highlights the importance of validating all claims from third-party identity providers rather than trusting them implicitly, a fundamental security principle in modern authentication systems.