Dashboard / CVE-2026-76792

CVE-2026-76792

HIGH
MEDIUM Priority: 0.01 BB Relevance: 66/100
Published: 2026-11-12 Modified: 2026-11-12 First seen: 2026-11-12 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown User Verification by PickPlugins 2.0.38 < 2.0.49
Unknown User Verification by PickPlugins 2.0.38 < 2.0.49

References & Advisories (1)

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

8.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.14%
Raw Score 0.001370
Percentile 3.1%
Date 2026-11-12

Intelligence Sources

mitre ref →
nvd ref →

External Links