User Verification By Pickplugins
Approved changes feed: RSS · Atom
cpe:2.3:a:pickplugins:user_verification_by_pickplugins:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pickplugins (03c448d6-40a7-5ce8-8d7e-bbbe6a0aa644) |
|---|---|
| Product | User Verification By Pickplugins (5cd9cef8-83e7-5361-a977-e6e64fd3a5cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7458 |
vulnerable | 2026-06-03 15:27:56.828713 |
User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
CRITICAL (9.8)
The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.
Published: 2026-05-02T04:27:43.795Z
Updated: 2026-05-04T14:54:08.894Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12374 |
vulnerable | 2026-06-03 14:58:44.232557 |
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover
CRITICAL (9.8)
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
Published: 2025-12-05T06:07:19.086Z
Updated: 2026-04-08T17:06:06.262Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.