Authentication Bypass in Email Verification Plugin for WordPress

CVE-2025-12374

What is CVE-2025-12374?

The Email Verification plugin for WordPress is susceptible to an authentication bypass vulnerability present in all versions up to and including 2.0.39. This issue arises from inadequate validation of the One-Time Password (OTP) generated by the system. Specifically, in the 'user_verification_form_wrap_process_otpLogin' function, the plugin fails to verify that an OTP was indeed generated before it is compared to user input. This oversight may allow unauthenticated attackers to gain unauthorized access by submitting a blank OTP field, enabling them to log in as any user with a verified email address, including administrators.

References