The User Verification plugin for WordPress allows unauthenticated attackers to bypass authentication by exploiting a loose PHP comparison operator used to validate one‑time passwords. An attacker can simply submit the string "true" as the OTP value, causing the comparison to succeed for any verified email address, and receive the privileges of that user.

WordPress sites running the PickPlugins User Verification plugin, all builds up to and including version 2.0.46, are vulnerable. The issue resides in the REST API endpoint that processes OTP submissions.

With a CVSS score of 9.8, this flaw is considered critical. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, but the lack of a verification requirement makes the attack straightforward and practical for remote actors. The likely attack vector is a remote, unauthenticated request to the OTP verification endpoint, where the attacker successfully logs in as any user with a verified email address.