PLUGIN SECURITY
Is User Verification by PickPlugins safe?
Email verification for user registration to protect spam.
What this plugin does
- Slug:
user-verification - Author: PickPlugins
- 4000+ active installs
- 90/100 rating (63 reviews on wordpress.org)
- 345852 all-time downloads
- On WordPress.org since 2016-11-14
Email OTPemail validationemail verificationhide loginpasswordless login
Maintenance status
- Last updated: 2026-11-05 3:06am GMT
- Tested up to WordPress: 7.1.4
Known vulnerabilities
6 known CVEs on file for User Verification by PickPlugins. Reported between 2022 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-76792 | Details unavailable | — | Unknown | 2.0.38–2.0.49 | 2.0.49 | 2026-11-12 | — |
| CVE-2026-7458 | User Verification by PickPlugins [user-verification] < 2.0.47 | Authentication Bypass Using an Alternate Path or Channel | Critical 9.8 | < 2.0.47 | 2.0.47 | 2026-05-01 | — |
| — | User Verification by PickPlugins [user-verification] <= 2.0.47 (unfixed) | Authorization Bypass Through User-Controlled Key | Unknown | < 2.0.47 | 2.0.47 | 2026-05-01 | — |
| CVE-2026-32497 | User Verification by PickPlugins [user-verification] < 2.0.46 | Weak Authentication | Medium 5.3 | < 2.0.46 | 2.0.46 | 2026-03-23 | — |
| CVE-2025-12374 | User Verification by PickPlugins [user-verification] < 2.0.45 | Improper Authentication | Critical 9.8 | < 2.0.45 | 2.0.45 | 2025-12-04 | — |
| CVE-2022-4693 | User Verification by PickPlugins [user-verification] < 1.0.94 | Improper Authentication | Critical 9.8 | < 1.0.94 | 1.0.94 | 2022-12-28 | — |
| CVE-2026-14861 | User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR | — | Unknown | not specified | no fix on file | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
1 of the vulnerabilities above has no fixed version on file — there's no update that resolves it. Consider deactivating this plugin or switching to one of the alternatives below.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.