Authentication Bypass in VentraConnect Plugin for WordPress
CVE-2026-18961

8.1HIGH

Key Information:

Vendor

WordPress
Status
Social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect
Vendor
CVE Published:
12 August 2026

What is CVE-2026-18961?

The VentraConnect plugin for WordPress is susceptible to an authentication bypass flaw that allows unauthenticated users to log in as any existing user, including administrators. This security issue arises from the plugin's reliance on unverified email information from Spotify's user-profile endpoint. Without proper verification, unauthorized attackers can exploit the vulnerability by supplying a valid email address through a manipulated Spotify OAuth flow, thus gaining administrative privileges on the compromised WordPress site.

Affected Version(s)

Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect 0 <= 1.4.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/ventraconnect-social-lo...
https://plugins.svn.wordpress.org/ventraconnect-social-lo...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Civitasmass
.