What is the CVSS score of EUVD-2026-57065?

EUVD-2026-57065 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 45.0%.

Which versions of VentraConnect Social Login are affected by EUVD-2026-57065?

VentraConnect Social Login WordPress plugin versions 1.4.3 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to hijack any WordPress account, including…

How to fix or mitigate EUVD-2026-57065?

Within 24 hours, conduct a full audit of WordPress installations to identify all use of VentraConnect Social Login plugin version 1.4.3 or earlier, document affected user accounts and administrative accounts, and review Spotify authentication logs for suspicious activity. Within 7 days, uninstall the VentraConnect Social Login plugin from all affected WordPress sites and replace it with an alternative authentication mechanism (such as an updated plugin version if available, a different social login provider with email verification, or temporary removal of social login functionality). Within 30 days, conduct a forensic review of account access logs dating back 90 days for evidence of unauthorized access, reset passwords for all previously exposed accounts, and establish automated monitoring to detect future unauthorized administrative logins.

VentraConnect Social Login EUVD-2026-57065

| CVE-2026-18961 HIGH

Improper Authentication (CWE-287)

2026-08-12 Wordfence

GHSA-m726-5v3m-hhqg

Authentication Bypass WordPress Social Login Passkeys Magic Link Email Otp Passwordless Login By Ventraconnect

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AV:N and PR:N confirmed by OAuth network flow requiring no prior WordPress access; AC:H reflects prerequisite of controlling a Spotify account presenting the target email; full C/I/A justified by administrator account takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 03:02 vuln.today

CVE Published

Aug 12, 2026 - 02:25 cve.org

HIGH 8.1

DescriptionCVE.org

The Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership - Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High Severity Aug 12, 2026

AnalysisAI

Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Delivery

Navigate to WordPress site's Spotify OAuth login endpoint

Exploit

Plugin exchanges code for token and calls Spotify /v1/me

Install

normalize_common() copies unverified email into normalized profile

link_or_login_user() calls get_user_by('email') and matches existing admin

Execute

wp_set_auth_cookie() issues persistent admin session cookie

Impact

Attacker accesses wp-admin with full administrative privileges

Recon

Delivery

Navigate to WordPress site's Spotify OAuth login endpoint

Exploit

Plugin exchanges code for token and calls Spotify /v1/me

Install

normalize_common() copies unverified email into normalized profile

link_or_login_user() calls get_user_by('email') and matches existing admin

Execute

wp_set_auth_cookie() issues persistent admin session cookie

Impact

Attacker accesses wp-admin with full administrative privileges

Vulnerability AssessmentAI

Exploitation	The plugin must be installed and active on the WordPress site, and the Spotify OAuth provider must be enabled within the plugin's configuration - the vulnerability exists only in the Spotify integration path due to Spotify's /v1/me endpoint not providing an email_verified field. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately captures the severity: full triad impact with no required privileges or user interaction, tempered by AC:H because the attacker must control a Spotify account presenting the exact target email. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who knows the email address of a WordPress Administrator on a target site (obtainable from author pages, checkout flows, or credential databases) registers or modifies a Spotify account to present that email via the /v1/me API endpoint, then navigates to the target WordPress site's Spotify OAuth login flow. The plugin fetches the unverified email, matches it to the administrator account without any verification challenge, and issues a persistent wp_set_auth_cookie session - granting the attacker full wp-admin access within a single OAuth round-trip. …
Remediation	Update the VentraConnect Social Login plugin to the version incorporating WordPress SVN changeset 3642024, which represents the upstream fix committed to the plugin repository (plugins.trac.wordpress.org/changeset/3642024/ventraconnect-social-login); however, the specific released version number containing this fix has not been independently confirmed from available data - verify the current version in the WordPress plugin directory before updating. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a full audit of WordPress installations to identify all use of VentraConnect Social Login plugin version 1.4.3 or earlier, document affected user accounts and administrative accounts, and review Spotify authentication logs for suspicious activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.