CVE-2026-76792 · Package
NO FIX YET · SEE WHAT TO DO
The User Verification by PickPlugins WordPress plugin does not rate limit the one-time-password check during login and never expires the generated code. When the code uses digits only, an unauthenticated attacker can guess it and log in as any user, including administrators.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the User Verification by PickPlugins WordPress plugin before 2.0.49 with its one-time-password login enabled and digits-only codes configured. Sites without the plugin, or with it on a version of 2.0.49 or later, are not affected.
Not affected if otp-login-disabled, plugin-not-installed, version-2.0.49-or-later
Who cares self-hosted, wordpress, wordpress-plugins
User Verification plugin by PickPlugins is installed and its version in the WordPress admin under Plugins.2.0.49 or laterThe User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.