CVE-2026-18961 Overview
CVE-2026-18961 is an authentication bypass vulnerability in the Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress. The flaw affects all versions up to and including 1.4.3. The plugin trusts the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership. Unauthenticated attackers can log in as any existing WordPress user, including Administrators, by supplying a target email address through a controlled Spotify OAuth flow. The issue is tracked under [CWE-287] Improper Authentication.
Critical Impact
Attackers can gain full administrative access to affected WordPress sites without prior credentials or user interaction.
Affected Products
- VentraConnect Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login plugin for WordPress
- All plugin versions up to and including 1.4.3
- WordPress sites with the plugin enabled and Spotify OAuth provider configured
Discovery Timeline
- 2026-08-12 - CVE-2026-18961 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18961
Vulnerability Analysis
The vulnerability resides in the OAuth login flow for the Spotify provider. The Spotify Web API /v1/me endpoint returns an email field, but that field is not asserted as verified. The plugin treats it as authoritative proof of mailbox ownership. This assumption enables account takeover of any known WordPress account, including Administrator accounts.
Because the attacker only needs to know a target's email address and control a Spotify account configured with that address, the barrier to exploitation is low. Successful exploitation yields full administrative control, enabling arbitrary plugin installation, content modification, and pivoting into deeper site compromise.
Root Cause
The root cause is a missing verified-email gate in the provider normalization and account-linking logic. Generic::normalize_common() copies Spotify's raw email value into the normalized profile without requiring an email_verified assertion from the identity provider. User_Links::link_or_login_user() then passes that email directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie(). No provider-specific verification, local mailbox challenge, or logged-in approval step is performed before the session is minted.
Attack Vector
An unauthenticated attacker registers or configures a Spotify account using the target victim's email address as the Spotify profile email. The attacker then initiates the Spotify OAuth flow on the vulnerable WordPress site. The plugin retrieves the profile from /v1/me, extracts the unverified email, and matches it to the existing WordPress user record. The plugin subsequently issues an authenticated session cookie for that user, granting full account access.
The vulnerability described above stems from trusting third-party provider claims without an email_verified check. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset #3642024 for technical details.
Detection Methods for CVE-2026-18961
Indicators of Compromise
- Unexpected successful logins to Administrator or high-privilege accounts originating from the Spotify OAuth callback endpoint.
- Creation of new administrator accounts, plugin installations, or theme edits shortly after a Spotify OAuth login event.
- WordPress wp_set_auth_cookie session issuance for users who have never previously linked a Spotify identity.
Detection Strategies
- Review web server access logs for requests to the VentraConnect OAuth callback URL followed by administrative activity from the same session.
- Correlate WordPress user activity logs with authentication events sourced from the Spotify provider path.
- Alert on privilege escalation events or new administrator role assignments that follow social login flows.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record login events, plugin changes, and role modifications.
- Monitor for anomalous geolocation or user-agent patterns during Spotify-initiated OAuth sessions.
- Track file integrity of wp-content/plugins and theme directories for unauthorized modifications following authentication events.
How to Mitigate CVE-2026-18961
Immediate Actions Required
- Update the VentraConnect Social Login plugin to a version later than 1.4.3 that incorporates the fix from changeset 3642024.
- If a patched version is not yet deployable, disable the plugin or disable the Spotify OAuth provider within the plugin configuration.
- Audit existing WordPress user accounts, especially Administrators, and rotate credentials and session tokens.
Patch Information
The vendor addressed the issue in WordPress Plugin Changeset #3642024. Site administrators should upgrade to the fixed release available from the WordPress plugin repository and verify that Spotify OAuth logins now require verified-email assertions.
Workarounds
- Disable the Spotify provider in the VentraConnect plugin settings until a patched version is installed.
- Restrict social login options to providers that expose an email_verified claim and are known to validate it.
- Require administrators to authenticate only via password plus multi-factor authentication, disallowing social login for privileged roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
