# User Verification <= 2.0.48 - Unauthenticated Authentication Bypass via Email OTP Brute Force

- **ID:** WPSEC-2026-2629
- **Plugin:** User Verification by PickPlugins (`user-verification`), https://wordpress.org/plugins/user-verification/
- **Affected versions:** from 2.0.37 before 2.0.49
- **Fixed in:** 2.0.49 (Update to 2.0.49 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/user-verification
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2629/

## Description

The User Verification plugin for WordPress is vulnerable to Authentication Bypass via the email OTP login form (the otpLogin REST form processor) in all versions up to, and including, 2.0.48. This is due to missing rate limiting on the code verification step: the plugin checks the per-user attempt counter but only increments it when an OTP is requested, never when a code is submitted, and the stored OTP never expires. This makes it possible for unauthenticated attackers to request one code and then submit unlimited guesses until they log in as another user, including an administrator. The attack is practical on sites that use the email OTP login form with a short or numeric OTP setting.

## References

- https://wpsec.com/vuln/WPSEC-2026-2629/
- https://plugins.svn.wordpress.org/user-verification/tags/2.0.49/
- https://wordpress.org/plugins/user-verification/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2629/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.