User Verification EUVD-2026-15843

While a formal CVSS score is unavailable, the vulnerability represents moderate-to-high real-world risk based on available signals: the attack vector is network-based with low complexity (typical of authentication bypass issues), requires no special privileges, and has material impact on authentication integrity. The classification as CWE-1390 (weak authentication) and the Patchstack reporting indicate this is a confirmed, reproducible vulnerability rather than theoretical. The ENISA EUVD tracking (EUVD-2026-15843) and specific version range (≤2.0.45) suggest this has undergone vulnerability assessment and coordination. The absence of EPSS data and KEV/POC confirmation from public sources does not diminish risk—email verification bypass vulnerabilities are commonly exploited in real-world WordPress compromise chains. Sites using User Verification should prioritize patching, as this directly weakens a primary authentication control. The practical risk is high for any site relying on email verification for user trust.

An attacker could register a new user account on a vulnerable WordPress site using a spoofed or attacker-controlled email address, then leverage the email verification bypass to activate the account without receiving or responding to a legitimate verification email. This allows the attacker to gain authenticated access to the site, potentially escalate privileges if the plugin is misconfigured to assign elevated roles, or pivot to access sensitive user data. In a second scenario, an attacker could attempt to register using the email address of a legitimate site administrator, bypassing verification to effectively impersonate that user and gain administrative access to the WordPress backend.