{"id":"CVE-2026-76792","kind":"vulnerability","aliases":["CVE-2026-76792"],"related":[],"title":"WordPress User Verification plugin: brute-forceable login code lets attackers log in","description":"The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.","summary":"The User Verification by PickPlugins WordPress plugin does not rate limit the one-time-password check during login and never expires the generated code. When the code uses digits only, an unauthenticated attacker can guess it and log in as any user, including administrators.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["otp-login-disabled","plugin-not-installed","version-2.0.49-or-later"],"how_to_check":"- Check whether the `User Verification` plugin by PickPlugins is installed and its version in the WordPress admin under Plugins.\n- Check whether the plugin's one-time-password login is enabled and set to digits-only codes.","fix":"- User Verification by PickPlugins: move to `2.0.49` or later","status":"open","published_at":"2026-11-12T06:17:14+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","triaged_at":"2026-11-12T06:37:44+00:00","updated_at":"2026-11-12T06:37:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- User Verification by PickPlugins: move to `2.0.49` or later","reach":"internet","title":"WordPress User Verification plugin: brute-forceable login code lets attackers log in","impact":"high","summary":"The User Verification by PickPlugins WordPress plugin does not rate limit the one-time-password check during login and never expires the generated code. When the code uses digits only, an unauthenticated attacker can guess it and log in as any user, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker logs in as administrator and takes over the site","analyst_note":"","how_to_check":"- Check whether the `User Verification` plugin by PickPlugins is installed and its version in the WordPress admin under Plugins.\n- Check whether the plugin's one-time-password login is enabled and set to digits-only codes.\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.0.49-or-later","otp-login-disabled"],"who_is_affected":"Sites running the User Verification by PickPlugins WordPress plugin before 2.0.49 with its one-time-password login enabled and digits-only codes configured. Sites without the plugin, or with it on a version of 2.0.49 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000726,"input_tokens":4545,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76792':15A,18A '2.0.49':80C 'administr':71B,116C 'allow':102C 'attack':11A,60B,104C 'brute':6A,106C 'brute-forc':5A 'check':43B 'code':9A,51B,54B,101C,119C 'configur':121C 'cve':13A,16A 'digit':56B,124C 'expir':48B,98C 'forc':107C 'forceabl':7A 'generat':50B,100C 'guess':62B 'host':22B 'includ':70B,115C 'let':10A 'limit':37B,84C 'log':12A,65B,110C 'login':8A,45B,94C 'never':47B 'one':40B,91C 'one-time-password':39B,90C 'packag':19B 'password':42B,93C 'pickplugin':31B,76C 'plugin':4A,26B,33B,78C 'rate':36B,83C 'self':21B 'self-host':20B 'step':87C 'time':41B,92C 'unauthent':59B,103C 'use':55B,123C 'user':2A,28B,69B,73C,114C 'verif':3A,29B,74C,86C 'wordpress':1A,23B,25B,32B,77C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Verification by PickPlugins WordPress plugin before 2.0.49 with its one-time-password login enabled and digits-only codes configured. Sites without the plugin, or with it on a version of 2.0.49 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","selfhosted","wordpress","wordpressplugins"],"campaign_type":null,"search_a":"'-2026':14A,17A '-76792':15A,18A 'attack':11A 'brute':6A 'brute-forc':5A 'code':9A 'cve':13A,16A 'forceabl':7A 'let':10A 'log':12A 'login':8A 'plugin':4A 'user':2A 'verif':3A 'wordpress':1A","search_b":"'administr':71B 'attack':60B 'check':43B 'code':51B,54B 'digit':56B 'expir':48B 'generat':50B 'guess':62B 'host':22B 'includ':70B 'limit':37B 'log':65B 'login':45B 'never':47B 'one':40B 'one-time-password':39B 'packag':19B 'password':42B 'pickplugin':31B 'plugin':26B,33B 'rate':36B 'self':21B 'self-host':20B 'time':41B 'unauthent':59B 'use':55B 'user':28B,69B 'verif':29B 'wordpress':23B,25B,32B 'wordpress-plugin':24B","search_c":"'2.0.49':80C 'administr':116C 'allow':102C 'attack':104C 'brute':106C 'code':101C,119C 'configur':121C 'digit':124C 'expir':98C 'forc':107C 'generat':100C 'includ':115C 'limit':84C 'log':110C 'login':94C 'one':91C 'one-time-password':90C 'password':93C 'pickplugin':76C 'plugin':78C 'rate':83C 'step':87C 'time':92C 'unauthent':103C 'use':123C 'user':73C,114C 'verif':74C,86C 'wordpress':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76792","severity":null,"published_at":"2026-11-12T06:17:14+00:00","modified_at":"2026-11-12T06:17:14+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","fetched_at":"2026-11-12T06:36:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}