CVE-2026-7458: PickPlugins User Verification WordPress Plugin: Authentication Bypass

Overview

CVE-2026-7458 describes an authentication bypass in the User Verification plugin by PickPlugins for WordPress. The record attributes the flaw to a loose PHP comparison used when validating OTP codes during login. The CNA is Wordfence, and the record was published on 2026-05-02 with a status of Deferred. Details are available in the Wordfence advisory and the NVD entry.

Impact

• The record classifies the issue as critical with a CVSS base score of 9.8, and the metrics indicate high impact on confidentiality, integrity and availability.
• According to the description, an unauthenticated attacker could log in as any user with a verified email address, including administrators.
• Account takeover of administrator accounts would likely give control over site content, plugins and users (inference from the description).

Affected products and versions

• The description states that all versions up to and including 2.0.46 are affected.
• The structured affected list in the record is empty, so the lower bound of the affected range is unknown.
• The record lists no fixed version. A reference to a plugin changeset is present, but the record does not state which release contains the fix.

Exploitation status

• The CISA KEV catalogue does not list this CVE in the record, so active exploitation is not confirmed by that source.
• The EPSS probability is 0.00844 with a percentile of 0.56883 in the record.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Identify all sites running the plugin and record their installed version, especially any at 2.0.46 or lower.
• Check the vendor and WordPress plugin repository pages for a patched release, since the record does not provide one.
• If no patched version is available, consider disabling the plugin until the vendor publishes a fix, and review whether its login functionality is needed.
• Review administrator and other privileged accounts, reset credentials where there is doubt, and invalidate active sessions after investigation.
• Add or confirm multi-factor protection for privileged accounts through a mechanism independent of this plugin (inference).

Detection guidance

• Review authentication logs for administrator logins that do not match known staff activity or expected times.
• Look for newly created administrator accounts, role changes and unexpected sessions.
• Monitor requests to the plugin's OTP login flow from unauthenticated sources and correlate them with successful logins.
• Compare site file integrity against a known-good baseline if compromise is suspected.

Limitations of the available information

• The record has no fixed version, no lower bound for affected versions, and no vendor-supplied remediation details.
• The affected products list is empty, so the scope relies on the description text alone.
• Only the CNA score is present; no other CVSS provider scores are listed.
• The record status is Deferred, and the sources consulted do not confirm exploitation or public exploit availability.

Frequently asked questions

Which versions are affected by CVE-2026-7458?

The description states that all versions up to and including 2.0.46 are affected. The structured affected list in the record is empty.

Is there a fixed version available?

The record does not list a fixed version. A plugin changeset is referenced, but the record does not state which release contains the fix, so check the vendor and WordPress repository pages.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalogue in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.