User Verification by PickPlugins vulnerabilities
We track 2 vulnerabilities in User Verification by PickPlugins products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest User Verification by PickPlugins vulnerabilities
- 8.1 High severity
User Verification by PickPlugins: Improper Authentication
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, i
- 7.5 High severity
User Verification by PickPlugins: Authorization Bypass Through User-Controlled Key
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to rese