Civitasmass

**Name of the Vulnerable Software and Affected Versions** Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect versions prior to 1.4.4 **Description** An authentication bypass exists when using Spotify OAuth. The plugin trusts the unverified email field returned by the Spotify '/v1/me' endpoint as proof of mailbox ownership. Specifically, the `Generic::normalize common()` function copies this value into the normalized profile without requiring an `email verified` assertion. Subsequently, the `User Links::link or login user()` function passes this value to `get user by('email', $email)` and issues a persistent authentication cookie via `wp set auth cookie()` without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by providing a target email address through a controlled Spotify OAuth flow. **Recommendations** Update the plugin to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.8 **Description** An authentication bypass exists that allows for account takeover via the `billing phone` parameter. The issue occurs because the `processRegistration()` function relies on a `$ SESSION['sa mobile verified']` boolean flag to issue an authentication cookie. Since this flag is not bound to a specific phone number, an unauthenticated attacker can verify a phone number they control to set the flag to `true`, and then resubmit the registration request using a victim's `billing phone`. This triggers the `wp set auth cookie()` function for the victim's account, granting the attacker full access to any WordPress user account with a known or guessable phone number, including administrator accounts. **Recommendations** Update the plugin to a version newer than 3.9.7.

**Name of the Vulnerable Software and Affected Versions** pCloud WP Backup versions prior to 2.0.4 **Description** An issue exists in the `wp2pcl ajax process request inner` function that allows authenticated users with subscriber-level access or higher to force the generation of a full-site backup archive. This archive is stored in a publicly accessible `tmp/` directory at a predictable URL, enabling unauthenticated visitors to access sensitive data. The exposed information includes the `wp-config.php` file containing database credentials, WordPress secret salts, and the entire PHP source tree. **Recommendations** Update pCloud WP Backup to version 2.0.4 or later.