CVE-2026-76792: User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

Published Nov 12, 2026

Updated

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade User Verification by PickPlugins WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.0.49

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to account takeover?

Sites using User Verification by PickPlugins before version 2.0.49 are exposed when the OTP login code is configured to use digits only. An attacker can target any account, including administrator accounts.

What does an attacker need to exploit this issue?

The attack is unauthenticated. The attacker brute-forces the OTP verification step because it has no rate limiting and generated codes do not expire.

What configuration detail should be checked during triage?

Check whether the plugin's OTP login verification codes are configured as digits only. That condition is specifically identified as enabling brute-force account takeover.

CVE-2026-76792: User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to account takeover?

What does an attacker need to exploit this issue?

What configuration detail should be checked during triage?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to account takeover?

What does an attacker need to exploit this issue?

What configuration detail should be checked during triage?