CVE-2026-18961: WordPress VentraConnect Plugin Authentication Bypass

Overview

A high-severity authentication bypass vulnerability (CVSS 8.1) has been disclosed in the Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect WordPress plugin. Tracked as CVE-2026-18961, the flaw affects all plugin versions up to and including 1.4.3 and allows an unauthenticated attacker to log in as any registered WordPress user — including administrators — without knowing their credentials.

The vulnerability was patched in version 1.4.4, released August 2026. Site administrators should apply the update immediately.

Technical Details

The vulnerability exists in how the VentraConnect plugin handles OAuth-based social login flows. When a user authenticates via a third-party identity provider (such as Google, Microsoft, or Apple), the plugin receives an email address claim from the provider and maps it to an existing WordPress user account without verifying that the email claim is authentic or tied to the authenticated session.

An attacker who can craft or intercept the provider's OAuth callback response can supply an arbitrary verified email address. Because the plugin does not validate the provider's assertion against a server-side token or user-specific nonce, the attacker is granted a WordPress session for the target account.

Attack vector: Network (unauthenticated) Attack complexity: High Privileges required: None User interaction: None Impact: Full account takeover, including administrator-level access

Affected Products

Patch Information

Update via Dashboard → Plugins → Update Available or via WP-CLI:

wp plugin update ventraconnect-social-login

Impact Assessment

Successful exploitation grants the attacker a fully authenticated WordPress session for any targeted account. Administrative account compromise enables:

• Full site takeover and content modification
• Installation of malicious plugins or themes
• Credential harvesting for connected services
• Persistent backdoor installation via plugin or file upload

No proof-of-concept exploit code has been publicly disclosed at time of publishing, but given the CVSS 8.1 severity score and the account-takeover impact, exploitation attempts are anticipated as awareness of the flaw spreads.

Remediation

1. Update immediately: Upgrade to VentraConnect Social Login version 1.4.4 or later
2. Review admin accounts: Audit administrator accounts for unexpected additions or recent login activity from unfamiliar IPs
3. Enable login notifications: Configure WordPress to send email alerts on administrator logins
4. Review WordPress security logs: Identify any suspicious authentication events from the disclosure window

Indicators of Compromise

• Unexpected admin account sessions or newly created administrator users
• Social login attempts against accounts that do not have a matching linked provider account
• High-volume OAuth callback requests from a single IP address

References

• NVD: CVE-2026-18961
• WordPress Plugin Repository: VentraConnect Social Login