PickPlugins Vulnerabilities and Affected Products
Vulnerabilities associated with User Verification by PickPlugins.
Products
Clear product- Post Grid12 vulnerabilities
- Job Board Manager9 vulnerabilities
- Post Grid and Gutenberg Blocks8 vulnerabilities
- Wishlist6 vulnerabilities
- Accordion5 vulnerabilities
- post_grid4 vulnerabilities
- post_grid_combo4 vulnerabilities
- Product Slider for WooCommerce3 vulnerabilities
- Question Answer3 vulnerabilities
- Team Showcase3 vulnerabilities
- Testimonial Slider3 vulnerabilities
- Accordions2 vulnerabilities
- Mail Picker2 vulnerabilities
- PickPlugins Product Designer for WooCommerce2 vulnerabilities
- Product Designer2 vulnerabilities
- product_designer2 vulnerabilities
- User Verification by PickPlugins2 vulnerabilities
- ComboBlocks1 vulnerability
- page_builder_comboblocks1 vulnerability
- PickPlugins Pricing Table1 vulnerability
- PickPlugins Product Slider for WooCommerce1 vulnerability
- PickPlugins Question Answer1 vulnerability
- Post Grid and Gutenberg Blocks – ComboBlocks1 vulnerability
- Post Grid Combo – 36+ Gutenberg Blocks1 vulnerability
- product_slider_for_woocommerce1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-7458CRITICAL | User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API EndpointThe User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value. CWE-288May 2, 2026 | CVSS9.8v3.1 | EPSS0.578% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12374CRITICAL | Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account TakeoverThe Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email addres… CWE-287Dec 5, 2025 | CVSS9.8v3.1 | EPSS0.507% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |