CVE-2026-76792— User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

Quick assessment

Affected

Unknown User Verification by PickPlugins

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PickPlugins 开发的 WordPress 插件"User Verification"在 2.0.49 版本之前，未对其一次性密码登录的验证步骤实施速率限制，且生成的验证码不会过期。这导致未认证的攻击者能够对其进行暴力破解，从而以任意用户（包括管理员）身份登录，前提是验证码被配置为仅使用数字。

AI Predicted 9.8 Difficulty: Easy Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1110.001 · Password Guessing

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

Source: CVE Program / CVE List V5

Vulnerability Description

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	User Verification by PickPlugins	2.0.38 ~ 2.0.49	-

II. Public POCs for CVE-2026-76792

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-76792

请登录查看更多情报信息。

Other References for CVE-2026-76792 (1)

https://wpscan.com/vulnerability/e77de84b-3567-4ec6-a2dc-dce93c1fdc6f/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-76792

Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total

CVE-2026-122003		Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
CVE-2026-110072		Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr
CVE-2026-110041		Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E
CVE-2026-106027		Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v
CVE-2026-110959		Descope < 1.2.0 - Unauthenticated Account Takeover
CVE-2026-119039		Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti
CVE-2026-118421		WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVE-2026-118531		Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
CVE-2026-123044		ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVE-2026-119040		Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
CVE-2026-124665		Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v
CVE-2026-121498		Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR
CVE-2026-123092		WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio
CVE-2026-124652		Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR
CVE-2026-124653		Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
CVE-2026-124647		TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie
CVE-2026-124648		TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key
CVE-2026-124815		Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions
CVE-2026-124814		Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't
CVE-2026-124817		Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

IV. Related Vulnerabilities

Same product: User Verification by PickPlugins

Same vendor: Unknown