What is the CVSS score of EUVD-2026-57065?

EUVD-2026-57065 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 45.0%.

Which versions of VentraConnect Social Login are affected by EUVD-2026-57065?

VentraConnect Social Login WordPress plugin versions 1.4.3 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to hijack any WordPress account, including…

How to fix or mitigate EUVD-2026-57065?

Within 24 hours, conduct a full audit of WordPress installations to identify all use of VentraConnect Social Login plugin version 1.4.3 or earlier, document affected user accounts and administrative accounts, and review Spotify authentication logs for suspicious activity. Within 7 days, uninstall the VentraConnect Social Login plugin from all affected WordPress sites and replace it with an alternative authentication mechanism (such as an updated plugin version if available, a different social login provider with email verification, or temporary removal of social login functionality). Within 30 days, conduct a forensic review of account access logs dating back 90 days for evidence of unauthorized access, reset passwords for all previously exposed accounts, and establish automated monitoring to detect future unauthorized administrative logins.

VentraConnect Social Login EUVD-2026-57065

| CVE-2026-18961 HIGH

Improper Authentication (CWE-287)

2026-08-12 Wordfence

GHSA-m726-5v3m-hhqg

WordPress Authentication Bypass Wordpress Plugin Social Login Passkeys Magic Link Email Otp Passwordless Login By Ventraconnect

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AV:N and PR:N confirmed by OAuth network flow requiring no prior WordPress access; AC:H reflects prerequisite of controlling a Spotify account presenting the target email; full C/I/A justified by administrator account takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 03:02 vuln.today

CVE Published

Aug 12, 2026 - 02:25 cve.org

HIGH 8.1

DescriptionCVE.org

The Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership - Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High Severity Aug 12, 2026

AnalysisAI

Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.

Technical ContextAI

The vulnerability resides in a WordPress plugin that abstracts multiple passwordless authentication methods - social OAuth (including Spotify), magic links, passkeys, and email OTP - under a unified provider normalization layer. The affected code paths are documented in the plugin's SVN source at tags/1.4.3: class-oauth.php orchestrates the OAuth handshake; class-provider-generic.php contains normalize_common(), which ingests the raw provider API response; normalizer.php maps provider-specific fields to a common schema; and class-user-links.php contains link_or_login_user(), which resolves and authenticates the WordPress user. The root cause is CWE-287 (Improper Authentication): the design assumes the email field in Spotify's /v1/me response constitutes proof of mailbox ownership, but Spotify's API documentation (referenced in the CVE) explicitly does not guarantee email verification status - the field is present regardless of whether the Spotify account's email has been confirmed. This violates the OAuth 2.0 security principle that an ID token or userinfo email must carry an email_verified: true claim before being used for account binding. The affected CPE is cpe:2.3:a:fahdaslam:social_login,_passkeys,_magic_link_&_email_otp_-_passwordless_login_by_ventraconnect:*:*:*:*:*:*:*:*.

RemediationAI

Update the VentraConnect Social Login plugin to the version incorporating WordPress SVN changeset 3642024, which represents the upstream fix committed to the plugin repository (plugins.trac.wordpress.org/changeset/3642024/ventraconnect-social-login); however, the specific released version number containing this fix has not been independently confirmed from available data - verify the current version in the WordPress plugin directory before updating. As an immediate compensating control for sites unable to patch promptly, disable the Spotify OAuth provider within the plugin's settings to eliminate the vulnerable code path entirely; note this removes Spotify as a login method for legitimate users. As a secondary control, restrict the WordPress login surface using a Web Application Firewall rule to block or require additional authentication on the OAuth callback endpoint. Site administrators should also audit wp_usermeta and recent login logs for unexpected authentication events targeting high-privilege accounts, as successful exploitation leaves a standard WordPress session cookie with no anomalous indicators beyond a Spotify OAuth referrer.