Understand the trust rules VentraConnect uses when matching Social Login identities to existing WordPress accounts.
VentraConnect Free v1.4.4 hardened Social Login account matching so a provider email address is only used for existing-account matching when the provider explicitly indicates that the email is verified.
This guide focuses specifically on:
- What changed in v1.4.4
- Provider identity vs provider email
- Verified vs unverified email
- Why unverified email fallback is blocked
- The matching decision path
- How to test the hardened behaviour
What Changed in VentraConnect Free v1.4.4
VentraConnect Free v1.4.4 tightened Social Login account matching.
This hardening reduces the risk of linking a Social Login identity to the wrong WordPress account based only on an email address whose verification status is unknown.
Provider Identity vs Provider Email
These are two different pieces of information and they are not treated the same way.
Email presence is not the same as email verification. A provider returning an email address does not automatically make that email trusted for account matching.
Verified vs Unverified Email
Trust rule: provider email is only useful for existing-account matching when the provider explicitly supplies a trusted verified-email signal.
Why Unverified Email Fallback Is Blocked
Email-based matching can be sensitive because matching the wrong provider identity to an existing WordPress user could attach authentication access to the wrong account.
By requiring an explicit verified-email signal, VentraConnect avoids treating untrusted or ambiguous provider email data as sufficient proof that the Social Login identity belongs to an existing WordPress account.
VentraConnect does not weaken this rule just to make login succeed. If the provider does not supply the verification signal VentraConnect expects, email fallback matching is not used.
Matching Decision Flow
What happens after a safe existing-account match cannot be made depends on the site's account-creation rules and Guardrails. See Account Linking & Existing Users for that workflow.
Provider Differences Matter
Social providers do not all return identity and email-verification data in the same format.
VentraConnect relies on the provider-specific response and only treats email as trusted for matching when that provider supplies the explicit verification signal VentraConnect expects.
Do not assume every provider returns a verified email. Provider capabilities and returned profile data can differ.
How to Test the Hardened Matching Behaviour
Recommended test:
- Use a private/incognito browser session
- Test with an existing WordPress user
- Use a provider account whose email matches that WordPress user
- Confirm the provider returns the expected identity
- Confirm matching succeeds only when the provider email is trusted as verified
- Confirm an unverified or unknown-status email is not used as a fallback match
- Confirm an existing linked provider identity still authenticates the correct WordPress user
- Review VentraConnect diagnostics when a provider does not match as expected
Do not create a duplicate account just to complete the test. If you are testing account-linking behaviour, use the existing-user workflow documented separately.
