# PeproDev Ultimate Profile Solutions <= 8.3.0 - Authenticated (Subscriber+) Mobile Number Verification Bypass

- **ID:** WPSEC-2026-2649
- **Plugin:** PeproDev Ultimate Profile Solutions (`peprodev-ups`), https://wordpress.org/plugins/peprodev-ups/
- **Affected versions:** all versions before 8.3.20
- **Fixed in:** 8.3.20 (Update to 8.3.20 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/peprodev-ups
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2649/

## Description

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to a mobile number verification bypass in all versions up to, and including, 8.3.0. The check_verification_sms() function validates the submitted OTP code without confirming that it was sent to the submitted mobile number. In addition, the profile edit handler lets an editable mobile field be changed without new verification, and the existing verified flag is kept. This makes it possible for authenticated attackers, with Subscriber-level access and above, to have a mobile number they do not own saved and marked as verified on their account, for example by requesting a code to a number they control and then submitting a different number with that code. That number then becomes unavailable to its real owner.

## References

- https://wpsec.com/vuln/WPSEC-2026-2649/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2649/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.