User Verification <= 2.0.48 - Unauthenticated Authentication Bypass via Email OTP Brute Force
- ID
- WPSEC-2026-2629
- Plugin
- User Verification by PickPlugins (user-verification)
- Affected
- from 2.0.37 before 2.0.49
- Remediation
- Update to 2.0.49 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- User Verification on WPSec AttackSurface
- Fix released
- Published
Description
The User Verification plugin for WordPress is vulnerable to Authentication Bypass via the email OTP login form (the otpLogin REST form processor) in all versions up to, and including, 2.0.48. This is due to missing rate limiting on the code verification step: the plugin checks the per-user attempt counter but only increments it when an OTP is requested, never when a code is submitted, and the stored OTP never expires. This makes it possible for unauthenticated attackers to request one code and then submit unlimited guesses until they log in as another user, including an administrator. The attack is practical on sites that use the email OTP login form with a short or numeric OTP setting.
References
- https://wpsec.com/vuln/WPSEC-2026-2629/
- https://plugins.svn.wordpress.org/user-verification/tags/2.0.49/
- https://wordpress.org/plugins/user-verification/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS