CVE-2026-76792

UNKNOWN 0.0

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.

Vendor	unknown
Product	user verification by pickplugins
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for unknown user verification by pickplugins

Be the first to know when new unknown vulnerabilities affecting unknown user verification by pickplugins are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / User Verification by PickPlugins

2.0.38 < 2.0.49

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/e77de84b-3567-4ec6-a2dc-dce93c1fdc6f/

Credits

Revanth Hari Narayana Matte WPScan