Description

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T03:16:42.807Z",
  "pubdate": "2026-08-12T03:16:42.807Z",
  "executiveSummary": "The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress in all versions up to, and including, 1.4.3 is vulnerable to an Authentication Bypass via Unverified Provider Email.\nThe vulnerability arises because the plugin implicitly trusts the unverified email field returned by Spotify's /v1/me endpoint, treating it as definitive proof of mailbox ownership.\nThis flaw allows unauthenticated remote attackers to execute an authentication bypass and log in as any arbitrary WordPress user, including accounts with Administrator privileges, by supplying a known target email address via a controlled Spotify OAuth flow.\nThe impact of this vulnerability is critical, resulting in a complete compromise of confidentiality, integrity, and availability, granting full administrative access to vulnerable WordPress sites.\nExploitation requires no prior authentication and relies on the attacker manipulating the OAuth authorization flow using a victim's known email address.",
  "technicalDetails": "The root cause of the vulnerability resides in how the plugin handles external identity provider data during the OAuth authentication process.\nSpecifically, the vulnerable components include Generic::normalize_common() and User_Links::link_or_login_user().\nDuring the Spotify OAuth authentication process, the application queries the Spotify /v1/me endpoint to retrieve user profile information.\nThe Generic::normalize_common() function copies the email field returned by this endpoint directly into the normalized profile without verifying or requiring an email_verified assertion.\nSubsequently, User_Links::link_or_login_user() passes this unverified email address directly to the WordPress core function get_user_by('email', $email).\nIf a local WordPress account matches the supplied email address, the plugin immediately issues a persistent authentication cookie via wp_set_auth_cookie().\nThe execution path entirely lacks a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step to confirm legitimate ownership.\nAn unauthenticated attacker exploits this behavior by initiating a Spotify OAuth flow under their control and substituting or aligning the profile details to target a known administrative email address.\nBecause the plugin blindly trusts the unverified email property returned by the provider API, the application links the external session to the pre-existing local WordPress user.\nThe function wp_set_auth_cookie() then establishes a persistent authenticated session for the targeted user without secondary validation.\nPost-exploitation impact includes full administrative takeover of the WordPress instance, allowing the attacker to execute arbitrary code, install malicious plugins, modify site content, and compromise underlying server resources."
}