What is the CVSS score of EUVD-2026-26737?

EUVD-2026-26737 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of User Verification by PickPlugins are affected by EUVD-2026-26737?

User Verification by PickPlugins contains a critical authentication bypass allowing unauthenticated attackers to assume administrator access on WordPress sites by exploiting a flawed OTP validation…

How to fix or mitigate EUVD-2026-26737?

Within 24 hours: Identify all WordPress instances with User Verification by PickPlugins installed and document current versions via admin dashboard or WP-CLI. Within 7 days: Update User Verification by PickPlugins to version 2.0.47 or later on all affected sites. Within 30 days: Audit administrative user login logs for suspicious authentication events; reset credentials for all user accounts with administrative privileges; review access logs for the vulnerability exploitation patterns.

User Verification by PickPlugins EUVD-2026-26737

| CVE-2026-7458 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-02 security@wordfence.com

PHP WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26737

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

AnalysisAI

Authentication bypass in User Verification by PickPlugins for WordPress allows remote unauthenticated attackers to log in as any user with a verified email - including administrators - by submitting the string 'true' as the OTP code. The vulnerability stems from a loose PHP comparison operator (==) in the OTP validation logic, which treats the boolean true as equal to any non-zero numeric OTP value. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and EPSS data unavailable, this represents complete system compromise risk for WordPress sites running vulnerable versions (≤2.0.46). Fixed in version 2.0.47 per Wordfence advisory and WordPress plugin repository changeset 3519113.

Technical ContextAI

This vulnerability exploits PHP's loose comparison semantics ( operator) versus strict comparison (=). When validating OTP codes, the affected function user_verification_form_wrap_process_otpLogin uses a loose comparison that coerces types before evaluation. In PHP, the boolean true evaluates as equal to any non-zero integer when using , so submitting the string 'true' as an OTP bypasses validation against legitimate numeric codes. This is a textbook CWE-288 (Authentication Bypass Using an Alternate Path or Channel) combined with CWE-1023 (Incomplete Comparison with Missing Factors). The vulnerability exists across three template files in the email-otp-login-form feature and the REST API endpoint in functions-rest.php. WordPress plugins using OTP-based authentication must implement strict type checking (=) and validate input type before comparison to prevent type juggling attacks.

RemediationAI

Immediately update User Verification by PickPlugins to version 2.0.47 or later through the WordPress admin dashboard (Plugins → Updates) or manually download from the WordPress plugin repository. The fix (changeset 3519113) replaces loose PHP comparison operators with strict type-checking equivalents in OTP validation logic. After updating, review WordPress admin user accounts and access logs for suspicious authentication events since plugin installation - check for logins from unexpected IP addresses or geographic locations, particularly those coinciding with OTP login attempts. As a temporary compensating control if immediate patching is not feasible, disable the email OTP login feature via plugin settings or deactivate the entire plugin until patching is complete. Note that disabling OTP login will force users back to password-based authentication, which may require communication to user base. No .htaccess rules or firewall configurations can effectively block this vulnerability since the flaw is in application logic, not network-accessible endpoints. Full plugin deactivation is the only reliable pre-patch mitigation, accepting the trade-off of lost OTP authentication functionality.