Authentication Bypass in User Verification Plugin for WordPress by PickPlugins

CVE-2026-7458

What is CVE-2026-7458?

The User Verification plugin by PickPlugins for WordPress suffers from an authentication bypass vulnerability due to improper validation of OTP codes. Specifically, the issue arises from the use of a loose PHP comparison operator in the 'user_verification_form_wrap_process_otpLogin' function. As a consequence, attackers can exploit this flaw to authenticate as any user with a verified email address, including administrators, by submitting an arbitrary 'true' OTP value. This poses a significant risk to WordPress sites using this plugin, potentially allowing unauthorized access to sensitive user accounts and compromising site integrity.

References