Improper authentication in PickPlugins User Verification by PickPlugins
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PickPlugins | User Verification by PickPlugins | up to 2.0.44 | — | No fix listed | CNA |
- User Verification by PickPlugins VendorPickPlugins Affected up to 2.0.44 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-12374
- 2026-10-03 Alias added: GHSA-464w-3px7-55cm
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccb1304-326e-43af-b75d-23874f92ba8b?source=cve
- https://plugins.trac.wordpress.org/browser/user-verification/trunk/templates/email-otp-login-form/hook.php#L141
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442150%40user-verification&new=3442150%40user-verification&sfp_email=&sfph_mail=
More PickPlugins vulnerabilities
- TI-2022-04290 User Verification < 1.0.94 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2024-20653 WordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerability CVSS 3.1HIGH 8.7
- TI-2024-08948 Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-00811 Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access CVSS 3.1MEDIUM 5.4
- TI-2023-00160 PickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2022-04432 Breadcrumb < 1.5.33 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-12374 · CVE Program
- CVE-2025-12374 · NVD
- FIRST EPSS
- GHSA-464w-3px7-55cm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences