Description

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T06:17:34.067Z",
  "pubdate": "2026-08-19T06:17:34.067Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the User Verification by PickPlugins WordPress plugin through version 2.0.47, allowing unauthenticated threat actors to manipulate user account verification statuses.\nThe core vulnerability stems from a failure to validate authorization for requests targeting the email verification resend functionality and an absence of cryptographic binding between protecting tokens and specific user accounts.\nThe impact of this security flaw is severe, enabling remote attackers to reset the email-verification status of arbitrary users, including high-privileged administrators.\nBy successfully exploiting this flaw, attackers can effectively lock legitimate users and administrators out of their WordPress accounts, leading to a complete denial of access and potential administrative takeover scenarios.\nThe attack requires no prior authentication, lowering the exploitation barrier and exposing vulnerable WordPress installations to immediate integrity and availability risks.\nExploitation relies on interacting directly with the unauthenticated verification resend endpoint supplied by the affected plugin.",
  "technicalDetails": "The User Verification by PickPlugins plugin through version 2.0.47 suffers from a critical broken object level authorization (BOLA) and missing access control vulnerability within its email verification resend mechanism.\nThe root cause of the vulnerability involves two distinct security deficiencies: first, the application fails to verify whether an incoming request to resend a verification email is explicitly authorized to act upon the supplied target user; second, it does not securely bind the protecting token or request parameter to the specific user context.\nNetwork exposure is inherent to the web application interface, exposing the vulnerable endpoint to unauthenticated attackers over HTTP/HTTPS without requiring any pre-existing privileges or session cookies.\nThe step-by-step attack flow proceeds as follows: an unauthenticated attacker crafts an HTTP request targeting the plugin's email verification resend functionality. Because the backend code lacks proper session validation and authorization checks against the supplied user identifier, the application processes the request without confirming if the sender has rights to manage the target account.\nDue to the absence of token-to-user binding mechanisms, the application accepts arbitrary user parameters and executes the associated state-change logic.\nThe payload behavior forces the targeted user account's verification status to reset, placing the account into an unverified state.\nPost-exploitation impact includes the immediate lockout of the affected user, as the application revokes access or enforces re-verification flows that the legitimate user may be unable to complete, successfully locking out standard users and critical administrators alike."
}