{"id":"CVE-2026-7458","aliases":["EUVD-2026-26737","GHSA-wj4w-hrrv-32x7"],"status":"published","title":"User Verification by PickPlugins \u003c= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint","description":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the \"user_verification_form_wrap_process_otpLogin\" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a \"true\" OTP value.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00578,"percentile":0.48033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2026-05-02T04:27:43Z","modified":"2026-06-17T11:02:27Z","exploits":[{"source":"pocgithub","id":"SangSenimanWartefak/CVE-2026-7458","title":"SangSenimanWartefak/CVE-2026-7458","date":"2026-06-11","url":"https://github.com/SangSenimanWartefak/CVE-2026-7458"}],"products":[{"vendor":"pickplugins","product":"user verification by pickplugins"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b86488-8f68-4738-a9a8-76d0b7976165?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/hook.php%23L164?rev=3461175"},{"url":"https://plugins.trac.wordpress.org/browser/user-verification/trunk/includes/functions-rest.php%23L234?rev=3461175"},{"url":"https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/index.php%23L71?rev=3461175"},{"url":"https://plugins.trac.wordpress.org/changeset/3519113/user-verification"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7458"},{"url":"https://github.com/advisories/GHSA-wj4w-hrrv-32x7"}],"sources":{"cve":[{"id":"CVE-2026-7458","title":"User Verification by PickPlugins \u003c= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint","description":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the \"user_verification_form_wrap_process_otpLogin\" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a \"true\" OTP value.","status":"published","published":"2026-05-02T04:27:43.795Z","modified":"2026-05-04T14:54:08.894Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-26737","description":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the \"user_verification_form_wrap_process_otpLogin\" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a \"true\" OTP value.","status":"published","published":"2026-05-02T04:27:43Z","modified":"2026-05-04T14:54:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:05:17.945759Z"}],"ghsa":[{"id":"GHSA-wj4w-hrrv-32x7","title":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass...","description":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the \"user_verification_form_wrap_process_otpLogin\" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a \"true\" OTP value.","status":"published","published":"2026-05-02T06:30:24Z","modified":"2026-05-02T06:30:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:07:53.39389Z"}],"nvd":[{"id":"CVE-2026-7458","description":"The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the \"user_verification_form_wrap_process_otpLogin\" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a \"true\" OTP value.","status":"published","published":"2026-05-02T05:16:01.42Z","modified":"2026-06-17T11:02:27.51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:17.022502Z"}]}}