PT-2026-145720

CVE-2026-76792

·

Published

2026-11-12

·

Updated

2026-11-12

Description by

CVSS 3.1
8.1
High
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-287: Improper Authentication
Related identifiers
CVE-2026-76792
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com