CVE-2026-7458

CRITICAL

User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-7458. PoCs published by Cyber-DarkNay, zycoder0day.

AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2026-7458, which bypasses OTP authentication in PickPlugins User Verification plugin by leveraging a loose comparison vulnerability in the REST API endpoint.

Description

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

Exploits (2)

github WORKING POC
by Cyber-DarkNay · pythonpoc
https://github.com/Cyber-DarkNay/CVE-2026-7458

The repository contains a functional Python exploit for CVE-2026-7458, which bypasses OTP authentication in PickPlugins User Verification plugin by leveraging a loose comparison vulnerability in the REST API endpoint.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: PickPlugins User Verification ≤ 2.0.46
No auth needed
Prerequisites: WordPress site with vulnerable plugin active · valid email address of a user account
devstral-2 · analyzed Jun 11, 2026 Full analysis →
nomisec WORKING POC
by zycoder0day · poc
https://github.com/zycoder0day/CVE-2026-7458

This PoC exploits an authentication bypass vulnerability in the User Verification by PickPlugins WordPress plugin by leveraging a loose comparison flaw in the OTP verification process. It fetches a nonce, triggers an OTP request, and bypasses the OTP check by sending a boolean true value.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: User Verification by PickPlugins <= 2.0.46
No auth needed
Prerequisites: WordPress site with vulnerable plugin · valid email address of a user
devstral-2 · analyzed May 11, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 9.8
EPSS 0.0058
EPSS Percentile 43.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-288
Status published
Products (1)
pickplugins/User Verification by PickPlugins < 2.0.46
Published May 02, 2026
Tracked Since May 02, 2026