Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the User Verification by PickPlugins plugin allows unauthenticated attackers to bypass login protections. By submitting a specific value, an attacker can gain access to any user account, including administrator roles, on affected WordPress sites.
- Attackers can access any user account.
- This affects WordPress sites using the plugin.
- Unauthorized access can lead to data compromise.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can bypass the One-Time Password (OTP) authentication in the User Verification by PickPlugins WordPress plugin. By submitting a specific value in place of a valid OTP, the attacker can log in as any user, including administrators, assuming that user has a verified email address. This bypass leverages a weak comparison in the OTP validation logic to gain unauthorized access.
- No prior authentication needed.
- Target: WordPress plugin's login function.
- User must have verified email.
Live Threat
Current exploitation, exposure, and threat context
This authentication bypass vulnerability in a WordPress plugin is highly likely to be weaponized by attackers. The ease of exploitation, combined with the direct pathway to administrative access on a widely used platform, makes it an attractive target for widespread compromise. Its network-attackable nature and lack of privileges required for exploitation further increase its appeal.
- No public exploit details observed.
- Affects WordPress authentication process.
- No KEV listing signal.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline affected WordPress sites using the User Verification by PickPlugins plugin, as an unauthenticated attacker can bypass authentication and gain administrator access. Given the critical severity and lack of specific patch information in the provided context, immediate containment is crucial.
- Isolate affected WordPress instances.
- Monitor for unauthorized login attempts.
- Investigate plugin code for bypass logic.
