Executive brief
The VentraConnect Social Login WordPress plugin allows users to log in via OAuth providers like Spotify. The plugin incorrectly trusts unverified email addresses returned by OAuth providers without confirming the user actually owns that email address. An attacker can hijack any WordPress account, including administrator accounts, by providing a known email address through a controlled OAuth flow—granting full site access without needing the legitimate account owner's credentials or approval.
Technical details
The vulnerability is an authentication bypass stemming from improper trust of unverified email data. The Generic::normalize_common() function copies an unverified email field (which Spotify's /v1/me endpoint explicitly documents as unverified) into the normalized OAuth profile without requiring email_verified assertions. Subsequently, User_Links::link_or_login_user() passes this email directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() with no provider-specific verification, local mailbox challenge, or logged-in approval step. The attack is network-accessible and requires no authentication; an unauthenticated attacker supplies a known target email through a controlled OAuth flow to gain immediate admin access. All versions up to and including 1.4.3 are affected; patch availability is not stated in the advisory.
Affected products
- VentraConnect Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login up to and including 1.4.3
Timeline
- 2026-08-12: disclosed