CVE-2026-18961

Name of the Vulnerable Software and Affected Versions Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect versions prior to 1.4.4

Description An authentication bypass exists when using Spotify OAuth. The plugin trusts the unverified email field returned by the Spotify '/v1/me' endpoint as proof of mailbox ownership. Specifically, the Generic::normalize common() function copies this value into the normalized profile without requiring an email verified assertion. Subsequently, the User Links::link or login user() function passes this value to get user by('email', $email) and issues a persistent authentication cookie via wp set auth cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by providing a target email address through a controlled Spotify OAuth flow.

Recommendations Update the plugin to a version newer than 1.4.3.