CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
EUVD Score usedEUVD-2026-124289
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
- Record
EUVD-2026-124289- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
CVE ListNo score
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
- Record
CVE-2026-76792- Updated
- 2026-11-12
GitHub AdvisoriesGHSA-gmxr-g9qg-qjhgNo score
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the...
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
- Record
GHSA-gmxr-g9qg-qjhg- Updated
- 2026-11-12
NVDNo score
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
- Record
CVE-2026-76792- Updated
- 2026-11-12
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | EUVD, NVD | |
| published | EUVD | |
| products, published, references, title | CVE List | |
| aliases, products, references | EUVD | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-76792 is a high vulnerability (CVSS 8.1) in Pickplugins User Verification By Pickplugins, published November 12, 2026. No source lists public exploit code. No source names a fixed version.