{
 "id": "WPSEC-2026-0818",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0818/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0818/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0818/index.md",
 "title": "User Verification <= 2.0.46 - Unauthenticated Insecure Direct Object Reference to Account Lockout via Resend Verification",
 "description": "The User Verification plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.46. The resend-verification handler takes the target user ID from the request and checks only a nonce that is not bound to that user, and that nonce is shown to logged-out visitors. The handler then marks the target account as unverified and resets its activation key. This makes it possible for unauthenticated attackers to lock any user, administrators included, out of their account until it is verified again.",
 "plugin": {
  "slug": "user-verification",
  "name": "User Verification",
  "full_name": "User Verification by PickPlugins",
  "wordpress_org": "https://wordpress.org/plugins/user-verification/",
  "advisories_url": "https://wpsec.com/vuln/plugin/user-verification/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/user-verification"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.48",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.48"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.48",
 "remediation": "Update to 2.0.48 or later.",
 "fix_released": "2026-10-12T07:30:10+00:00",
 "published": "2026-10-13T07:51:38+00:00",
 "updated": "2026-10-12T11:57:22.950678+00:00",
 "also_published_as": {
  "source": null,
  "cve": [
   "CVE-2026-14861"
  ],
  "published": "2026-08-17T00:00:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0818/",
  "https://plugins.svn.wordpress.org/user-verification/tags/2.0.48/",
  "https://wordpress.org/plugins/user-verification/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/user-verification",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-13"
 }
}