CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/

Configurations

No configuration.

History

22 Oct 2026, 16:09

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress User Verification by PickPlugins hasta la versión 2.0.47 no verifica que una solicitud para reenviar un correo electrónico de verificación esté autorizada para actuar sobre el usuario proporcionado, ni vincula el token de protección a ese usuario, lo que permite a atacantes no autenticados restablecer el estado de verificación de correo electrónico de usuarios arbitrarios y bloquearlos, incluidos los administradores, fuera de sus cuentas.

Information

Published : 2026-08-19 06:17

Updated : 2026-10-22 16:09

NVD link : CVE-2026-14861

Mitre link : CVE-2026-14861

CVE.ORG link : CVE-2026-14861

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-14861", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14861", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T13:15:08.111449Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "User Verification by PickPlugins", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.47"}], "defaultStatus": "unknown"}]}], "published": "2026-08-19T06:17:34.067", "references": [{"url": "https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts."}, {"lang": "es", "value": "El plugin de WordPress User Verification by PickPlugins hasta la versi\u00f3n 2.0.47 no verifica que una solicitud para reenviar un correo electr\u00f3nico de verificaci\u00f3n est\u00e9 autorizada para actuar sobre el usuario proporcionado, ni vincula el token de protecci\u00f3n a ese usuario, lo que permite a atacantes no autenticados restablecer el estado de verificaci\u00f3n de correo electr\u00f3nico de usuarios arbitrarios y bloquearlos, incluidos los administradores, fuera de sus cuentas."}], "lastModified": "2026-10-22T16:09:59.560", "sourceIdentifier": "contact@wpscan.com"}