Unauthenticated Auth Bypass in VentraConnect Social Login Plugin via Spotify OAuth (CVE-2026-18961)

Vulnerability Overview Vulnerability Name: Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback CVE ID: CVE-2026-18961 CVSS Score: 8.1 (High) Release Date: August 11, 2026 Last Updated: August 12, 2026 Researcher: Civitasmash Impact Scope Affected Versions: <= 1.4.3 Fixed Version: 1.4.4 Remediation Fix Method: Update to version 1.4.4 or a later patched version. Vulnerability Description This vulnerability exists in the "Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login" plugin by VentraConnect, versions <= 1.4.3. The root cause is that the plugin trusts the unverified field returned by Spotify's endpoint as proof of email ownership. The function copies this value to a normalized profile object. Without requiring an email verification assertion, the function subsequently passes this value directly to and triggers the persistent authentication cookie via . This bypasses specific verification email gateways, local email challenges, or login approval steps. Consequently, an unauthenticated attacker can log in as any existing WordPress user, including administrators, by providing a known target email address. This is achieved through a controlled Spotify OAuth flow, granting the attacker full administrative access to the site. References plugins.svn.wordpress.org developer.spotify.com plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Tags: ventraconnect-social-login (view on wordpress.org) Patched: Yes Affected Versions: <= 1.4.3 Fixed Version: 1.4.4 Related Recent Vulnerabilities Vulnerability Title: Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force CVE ID: CVE-2026-13142 CVSS Score: 9.8 Researcher: WPScan, Pedro Pinto Date: June 23, 2026 Summary This vulnerability allows unauthorized users to bypass authentication via the Spotify OAuth callback, gaining full administrative access to the WordPress site. Users are advised to update to version 1.4.4 or later as soon as possible to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Auth Bypass in VentraConnect Social Login Plugin via Spotify OAuth (CVE-2026-18961)

More from this source