What is the CVSS score of EUVD-2025-201358?

EUVD-2025-201358 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WordPress are affected by EUVD-2025-201358?

This critical vulnerability allows any unauthenticated attacker to gain administrative access to WordPress sites running the affected User Verification plugin by bypassing OTP authentication with an…

How to fix or mitigate EUVD-2025-201358?

Within 24 hours: Identify all WordPress instances running the User Verification plugin (versions ≤2.0.39) and disable the OTP login functionality immediately. Within 7 days: Deactivate and remove the vulnerable plugin from all affected systems; implement alternative authentication mechanisms (SAML, OAuth, or native WordPress authentication). Within 30 days: Conduct full security audit of affected systems for unauthorized access, reset all administrative credentials, review access logs from plugin deployment date, and establish vendor communication plan for patch timeline.

WordPress EUVD-2025-201358

| CVE-2025-12374 CRITICAL

Improper Authentication (CWE-287)

2025-12-05 security@wordfence.com

WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:07 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201358

CVE Published

Dec 05, 2025 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login - User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.39. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.

AnalysisAI

Authentication bypass in the User Verification plugin for WordPress (versions ≤2.0.39) allows unauthenticated attackers to log in as any user with a verified email address, including administrators, by submitting an empty OTP value. The flawed OTP comparison function fails to check if an OTP was actually generated, enabling complete account takeover. No active exploitation or public exploit is known, but the low-complexity network attack makes it a critical priority for affected sites.