# User Verification <= 2.0.46 - Unauthenticated Insecure Direct Object Reference to Account Lockout via Resend Verification

- **ID:** WPSEC-2026-0818
- **Plugin:** User Verification by PickPlugins (`user-verification`), https://wordpress.org/plugins/user-verification/
- **Affected versions:** all versions before 2.0.48
- **Fixed in:** 2.0.48 (Update to 2.0.48 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/user-verification
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0818/

## Description

The User Verification plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.46. The resend-verification handler takes the target user ID from the request and checks only a nonce that is not bound to that user, and that nonce is shown to logged-out visitors. The handler then marks the target account as unverified and resets its activation key. This makes it possible for unauthenticated attackers to lock any user, administrators included, out of their account until it is verified again.

Also published later by another source as CVE-2026-14861.

## References

- https://wpsec.com/vuln/WPSEC-2026-0818/
- https://plugins.svn.wordpress.org/user-verification/tags/2.0.48/
- https://wordpress.org/plugins/user-verification/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0818/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.