CVE-2026-7458

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

• CWE-288

• https://plugins.trac.wordpress.org/browser/user-verification/trunk/includes/functions-rest.php%23L234?rev=3461175
• https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/hook.php%23L164?rev=3461175
• https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/index.php%23L71?rev=3461175
• https://plugins.trac.wordpress.org/changeset/3519113/user-verification
• https://www.wordfence.com/threat-intel/vulnerabilities/id/35b86488-8f68-4738-a9a8-76d0b7976165?source=cve

Published

May 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7451A maliciously crafted TIF file, when parsed through Autodesk…7.8
• CVE-2026-7452A maliciously crafted WRL file, when parsed through Autodesk…7.8
• CVE-2026-7453A maliciously crafted WRL file, when parsed through Autodesk…5.5
• CVE-2026-7454A maliciously crafted WRL file, when parsed through Autodesk…7.8
• CVE-2026-7456The Udimi Tools plugin for WordPress is vulnerable to unauth…6.5
• CVE-2026-7457The LatePoint plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-7459The Simple History – Track, Log, and Audit WordPress Changes…7.5
• CVE-2026-7460mailcow-dockerized contains a stored cross-site scripting vu…7.4
• CVE-2026-7461Improper neutralization of inputs used in an OS command in t…7.5
• CVE-2026-7462The VatanSMS WP SMS plugin for WordPress is vulnerable to Re…6.1
• CVE-2026-7464The WP Google Maps Integration plugin for WordPress is vulne…6.1
• CVE-2026-7465The Spectra Gutenberg Blocks – Website Builder for the Block…8.8