CVE-2025-12374 | The Email Verification, Email OTP, Block Spam Email, Passwor… | CVSS 9.8 CRITICAL

Description

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.

Metadata

CVE ID: CVE-2025-12374
State: PUBLISHED
Assigner: Wordfence
Reserved: 2025-10-27 21:22 UTC
Published: 2025-12-05 06:07 UTC
Last updated: 2026-04-08 17:06 UTC
Primary CWE: CWE-287
CWE-287 Improper Authentication
Vendor / Product: pickplugins / User Verification by PickPlugins
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
pickplugins	User Verification by PickPlugins	—	0 ≤ 2.0.44

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287 Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)