CVE-2026-7458

Critical

Published: 02/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to and including 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the 'user_verification_form_wrap_process_otpLogin' function.

Risk Assessment

Unauthenticated attackers can log in as any user with a verified email address, such as an administrator, by submitting a 'true' OTP value. This poses a serious security risk to the system.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, consider implementing further security measures in the login process.

Original NVD description (English source)

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.