The User Verification plugin for WordPress allows unauthenticated attackers to invoke a "resend verification email" endpoint without proper authorization checks or binding the action to the targeted account. This flaw permits an attacker to reset the email‑verification status of any user account, effectively locking them out of their accounts, including administrators. The vulnerability is a classic example of an insecure direct object reference (CWE‑639) and results in denial of access to legitimate users.

The issue affects the WordPress plugin User Verification by PickPlugins, versions up to and including 2.0.47. Any installation of the plugin at or below that version is potentially vulnerable; no other vendors are listed.

The flaw receives a CVSS score of 7.5, indicating high severity. The EPSS score is less than 1%, suggesting a low exploitation probability at present, and it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability from any location that can reach the WordPress site, requiring no authentication or elevated privileges. The simple HTTP call to the resend endpoint, lacking proper authorization checks, allows the attacker to lock out users without additional conditions.