https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T09:51:35.720815+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308370 EUVD-2026-308370 2026-10-07T09:51:35.777389+00:00 EUVD-2026-308370 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7458 fkie_cve-2026-7458 2026-10-07T09:51:35.777439+00:00

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.

 https://cve.radiocsirt.org/vuln/ghsa-wj4w-hrrv-32x7 GHSA-wj4w-hrrv-32x7 2026-10-07T09:51:35.777476+00:00

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value.