The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to th…

The User Verification by PickPlugins plugin for WordPress contains an authentication bypass vulnerability affecting all versions up to and including 2.0.46. The vulnerability stems from the use of a loose PHP comparison operator to validate OTP codes in the user_verification_form_wrap_process_otpLogin function. This flaw allows unauthenticated attackers to bypass authentication and log in as any user with a verified email address, including administrators, by simply submitting a 'true' OTP value. The vulnerability poses a critical risk as it enables complete account takeover of privileged users through a trivial exploit.