CVE-2026-18961

creationtimestamp| type| source ---|---|--- 2026-08-12 04:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msuakxj5u224 2026-08-12 04:17:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ixfla2u3udtbt 2026-08-13 23:16:07+00:00| seen|...

CVE-2026-18961

The CVE describes a vulnerability in the VentraConnect Social Login WordPress plugin (up to version 1.4.3) where an unverified email field returned by Spotify’s /v1/me endpoint is trusted as mailbox ownership. The plugin copies this value into a user profile and logs in the user via get_user_by('...

CVE-2026-18961 Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...