Unauthenticated Brute Force Vulnerability in User Verification Plugin by PickPlugins
CVE-2026-76792
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 November 2026
Badges
What is CVE-2026-76792?
The User Verification plugin by PickPlugins for WordPress versions prior to 2.0.49 is susceptible to a brute force attack due to lack of rate limiting on its one-time password login verification step. This vulnerability permits unauthenticated attackers to exploit the system and log in as any user, including those with administrative privileges, by repeatedly attempting to verify the one-time password. Furthermore, the generated codes are not set to expire, considerably heightening the risk of unauthorized access. It is critical for site administrators to update to the latest version to mitigate this security threat.
Affected Version(s)
User Verification by PickPlugins 2.0.38 < 2.0.49
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.