Descripción
The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the -user_verification_form_wrap_process_otpLogin- function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a -true- OTP value.
CVSS 9.8EPSS 0.5780000000000001%Riesgo 1.03
Ver fuente- Publicación
- 2026-05-02 05:16:01
- Versiones afectadas
- <=2.0.46
- Tipo
- Installed app
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H