CVE-2026-32497 MEDIUM

CVE-2026-32497: WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability

Vendor Pickplugins

Product User Verification

Weakness CWE-1390

Published March 25, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.

Explanation of Vulnerability in Simple Terms

02Summary

User Verification versions up to 2.0.45 contain an integrity vulnerability allowing network-based modification of data without authentication. The flaw requires no user interaction and affects the integrity of information processed by the plugin. Site administrators should update to a version newer than 2.0.45 to remediate this issue.

What an attacker can do

03Attacker Capabilities

Modify data processed by the plugin over the network without needing to log in.

Potential impact on your site

04Site Impact

Attackers can alter plugin data or functionality without credentials, potentially affecting user verification processes.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 25, 2026 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32497 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1390.html AskarLabs — CWE-1390 write-up Weak Authentication

Related vulnerabilities

Identifiers

CVE CVE-2026-32497

CWE CWE-1390

CVSS 5.3 / MEDIUM

Affected versions