PeproDev Ultimate Profile Solutions <= 8.3.0 - Authenticated (Subscriber+) Mobile Number Verification Bypass
- ID
- WPSEC-2026-2649
- Plugin
- PeproDev Ultimate Profile Solutions (peprodev-ups)
- Affected
- all versions before 8.3.20
- Remediation
- Update to 8.3.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- PeproDev Ultimate Profile Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to a mobile number verification bypass in all versions up to, and including, 8.3.0. The check_verification_sms() function validates the submitted OTP code without confirming that it was sent to the submitted mobile number. In addition, the profile edit handler lets an editable mobile field be changed without new verification, and the existing verified flag is kept. This makes it possible for authenticated attackers, with Subscriber-level access and above, to have a mobile number they do not own saved and marked as verified on their account, for example by requesting a code to a number they control and then submitting a different number with that code. That number then becomes unavailable to its real owner.
References
- https://wpsec.com/vuln/WPSEC-2026-2649/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS