Weak authentication in the PickPlugins User Verification plugin allows an attacker to bypass the email verification process during user registration or login. This grants the attacker the ability to assume any account without needing to access the associated email address, leading to unauthorized access to content and administrative functions. The vulnerability is identified as a weak authentication flaw (CWE‑1390).

The issue affects WordPress sites running the PickPlugins User Verification plugin through version 2.0.45. Any installation of this plugin within that version range is susceptible.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation can likely be achieved from the web interface by providing forged credentials or manipulating the registration flow, making the attack vector remote over the internet. Administrators should treat this as a medium‑to‑high risk in environments where email verification is the primary gate for account creation.