User Verification <= 2.0.46 - Unauthenticated Insecure Direct Object Reference to Account Lockout via Resend Verification
- ID
- WPSEC-2026-0818
- Plugin
- User Verification by PickPlugins (user-verification)
- Affected
- all versions before 2.0.48
- Remediation
- Update to 2.0.48 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-13
- Attack surface
- User Verification on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-14861, on 2026-08-17.
Description
The User Verification plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.46. The resend-verification handler takes the target user ID from the request and checks only a nonce that is not bound to that user, and that nonce is shown to logged-out visitors. The handler then marks the target account as unverified and resets its activation key. This makes it possible for unauthenticated attackers to lock any user, administrators included, out of their account until it is verified again.
References
- https://wpsec.com/vuln/WPSEC-2026-0818/
- https://plugins.svn.wordpress.org/user-verification/tags/2.0.48/
- https://wordpress.org/plugins/user-verification/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS