CVE-2025-12374

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.

• CWE-287

• https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/hook.php#L141
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442150%40user-verification&new=3442150%40user-verification&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccb1304-326e-43af-b75d-23874f92ba8b?source=cve

Published

Dec 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12368The Sermon Manager plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-12369The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2025-12370The Takeads plugin for WordPress is vulnerable to authorizat…4.3
• CVE-2025-12371The Nari Accountant plugin for WordPress is vulnerable to St…4.4
• CVE-2025-12372The Permalinks Cascade plugin for WordPress is vulnerable to…4.3
• CVE-2025-12373The Torod – The smart shipping and delivery portal for e-sho…4.3
• CVE-2025-12375The Printful Integration for WooCommerce plugin for WordPres…6.4
• CVE-2025-12376The Icon List Block – Add Icon-Based Lists with Custom Style…6.4
• CVE-2025-12377The Gallery Plugin for WordPress – Envira Photo Gallery plug…4.3
• CVE-2025-12378A security flaw has been discovered in code-projects Simple …9.8
• CVE-2025-12379The Shortcodes and extra features for Phlox theme plugin for…6.4
• CVE-2025-12380Starting with Firefox 142, it was possible for a compromised…9.8