External risk intelligence

WordPress User Verification Plugin Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12374

The vulnerability exists in a WordPress plugin designed for authentication, including login forms and user verification processes. Such plugins are typically deployed on public-facing websites to handle user interactions, making the authentication entry point directly reachable via the internet in standard configurations.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in a WordPress plugin used for email verification and login functions. The flaw allows unauthenticated attackers to bypass authentication mechanisms, potentially gaining unauthorized access to user accounts, including administrative ones, by exploiting how the system validates one-time passcodes. The main concern is confirming relevance and exposure.

Unauthenticated attackers can bypass logins.
Critical vulnerability affects user account access.
Assess plugin's presence and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication on a WordPress site by exploiting a flaw in the user verification plugin. This occurs when the plugin fails to check if a one-time password (OTP) was actually created before comparing it to what the user submitted. By sending an empty OTP, an unauthenticated attacker can gain access as any user with a verified email.

Unauthenticated network access required.
Empty OTP submitted to the login form.
Unrestricted access to any user account.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass the intended verification process and log in as any user with a verified email address. This could occur when the plugin improperly validates One-Time Passwords (OTPs) during the login or verification steps.

Admin accounts and user data at risk.
Attacker bypasses OTP validation.
Unauthorized account access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

For WordPress sites using the User Verification plugin, responsibility likely falls to the website administrator or the platform/DevOps team managing the WordPress instance. The initial priority is to identify all WordPress deployments utilizing this plugin, confirm their internet reachability and business criticality, and then engage the accountable owner to plan remediation.

Website owners and platform teams.
Verify plugin reachability and business impact.
Plan remediation and coordinate vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Email Verification plugin for WordPress?

This is a WordPress plugin designed to handle identity management tasks. It adds features like magic login links, email-based One-Time Passwords (OTPs), spam blocking, and hidden login forms to help site owners verify user identities and secure account access.

How does CVE-2025-12374 affect account security?

This vulnerability is classified as Improper Authentication (CWE-287). It means the plugin fails to check if a valid OTP was actually generated before verifying the user's input. Consequently, the system incorrectly treats specific malformed inputs as successful authentication, allowing access to accounts.

Do I need to have an active OTP session for this to trigger?

No. In fact, an active or valid OTP is not required to trigger the bug. An attacker can bypass the verification process entirely by submitting an empty value during the login attempt, which the plugin processes incorrectly as a valid credential.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, because this plugin manages authentication entry points often exposed to the public internet, it is highly reachable. If your WordPress site is internet-facing and uses this plugin, it is a primary target for unauthorized access.

When should I take action to secure my WordPress site?

You should prioritize this immediately. Start by auditing your WordPress environments to identify if this specific plugin is installed. Once identified, evaluate the business criticality of those sites and coordinate with your team to apply available vendor patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.