CVE-2026-7458 Auth bypass in User Verification by PickPlugins
Unauthenticated attackers can bypass OTP verification to log in as any user, including administrators, due to a loose comparison vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7458?
CVE-2026-7458 is a critical authentication bypass vulnerability in User Verification by PickPlugins, published on 2 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.
Weakness: CWE-288
Which versions are affected by CVE-2026-7458?
How do I fix CVE-2026-7458?
No fix has been published for CVE-2026-7458 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-7458 being exploited?
There is no known exploitation of CVE-2026-7458 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-wj4w-hrrv-32x7.