Now officially on WordPress.org

CVE Database / CVE-2025-12374

CVE · Critical

CVE-2025-12374 — User Verification by PickPlugins [user-verification] < 2.0.45

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-12374 User Verification by PickPlugins [user-verification] < 2.0.45 Improper Authentication Critical 9.8 < 2.0.45 2.0.45 2025-12-04 —

CVE-2025-12374

A WordPress plugin called Email Verification and User Verification has a security flaw that allows unauthorized access to accounts. The issue arises from the plugin not thoroughly checking whether an OTP was created before comparing it to user-submitted data in the "user_verification_form_wrap_process_otpLogin" function, which can be exploited by submitting an empty OTP value. This vulnerability affects all versions of the plugin up to and including 2.0.39.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings