What is the CVSS score of CVE-2025-12374?

CVE-2025-12374 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WordPress are affected by CVE-2025-12374?

This critical vulnerability allows any unauthenticated attacker to gain administrative access to WordPress sites running the affected User Verification plugin by bypassing OTP authentication with an…

How to fix or mitigate CVE-2025-12374?

Within 24 hours: Identify all WordPress instances running the User Verification plugin (versions ≤2.0.39) and disable the OTP login functionality immediately. Within 7 days: Deactivate and remove the vulnerable plugin from all affected systems; implement alternative authentication mechanisms (SAML, OAuth, or native WordPress authentication). Within 30 days: Conduct full security audit of affected systems for unauthorized access, reset all administrative credentials, review access logs from plugin deployment date, and establish vendor communication plan for patch timeline.

WordPress CVE-2025-12374

EUVD-2025-201358 CRITICAL

Improper Authentication (CWE-287)

2025-12-05 security@wordfence.com

Authentication Bypass WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201358

CVE Published

Dec 05, 2025 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login - User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.39. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.