CVE-2026-7458

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

• CWE-288

• https://plugins.trac.wordpress.org/browser/user-verification/trunk/includes/functions-rest.php%23L234?rev=3461175
• https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/hook.php%23L164?rev=3461175
• https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/index.php%23L71?rev=3461175
• https://plugins.trac.wordpress.org/changeset/3519113/user-verification
• https://www.wordfence.com/threat-intel/vulnerabilities/id/35b86488-8f68-4738-a9a8-76d0b7976165?source=cve

Published

May 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74574In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74575In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-74576In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-74577In the Linux kernel, the following vulnerability has been re…
• CVE-2026-74578In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-74579In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-74580In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-74581In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-74582In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74583In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74584In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-74585In the Linux kernel, the following vulnerability has been re…