CVE-2026-14861: User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it. No existing WordPress account or administrator privileges are required.
Which accounts can be affected?
The flaw allows an attacker to reset the email-verification status of arbitrary users, including administrator accounts. This can lock targeted users out of their accounts.
What attacker capability makes the attack possible?
The attacker needs to submit a request to resend a verification email while supplying the target user's identity. The plugin does not verify authorization for that supplied user and does not bind the protective token to that user.