Social Login Passkeys Magic Link Email Otp Passwordless Login By Ventraconnect
Monthly
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.