Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-7458

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

View on NVD

Analysis

The User Verification by PickPlugins plugin for WordPress contains a critical authentication bypass vulnerability in versions up to 2.0.46. Due to loose PHP comparison logic, an unauthenticated attacker can log in as any user, including administrators, by providing a boolean true value instead of a valid OTP.

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-288

EPSS

Probability of exploitation (next 30 days): 0.0006 (0.1%)
Percentile: 19.9%
EPSS: 2026-05-06

Technical description

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

Published: 5/2/2026, 5:16:01 AM
Last modified: 5/5/2026, 7:17:22 PM

References

HomeEventsBlogResourcesTeam