CVE-2026-14861 Overview
CVE-2026-14861 affects the User Verification by PickPlugins WordPress plugin through version 2.0.47. The plugin fails to authorize resend-verification-email requests and does not bind the protecting token to the target user. Unauthenticated attackers can reset the email-verification status of arbitrary users, including administrators. Successful exploitation locks legitimate users out of their accounts by forcing them back into an unverified state. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key and represents an Insecure Direct Object Reference in the verification workflow.
Critical Impact
Unauthenticated remote attackers can lock any user, including administrators, out of their WordPress accounts by resetting email-verification state.
Affected Products
- User Verification by PickPlugins WordPress plugin versions up to and including 2.0.47
- WordPress installations using the affected plugin for email verification workflows
- Administrator accounts protected by the plugin's verification mechanism
Discovery Timeline
- 2026-08-19 - CVE-2026-14861 published to the National Vulnerability Database
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-14861
Vulnerability Analysis
The User Verification by PickPlugins plugin exposes a resend-verification-email endpoint intended to help users request a new verification message. The endpoint accepts a user identifier from the request but does not validate whether the requester is authorized to act on that account. It also fails to cryptographically bind the verification token to the target user, so the token acts as a generic key rather than a per-user secret. An unauthenticated attacker can call the endpoint with any user ID and trigger a state change on that account. The result is that the targeted user's email-verification status is reset, and their session or access is invalidated until verification completes again. Because administrators are not excluded from this workflow, attackers can lock privileged accounts out of the WordPress site.
Root Cause
The root cause is a missing authorization check combined with an unbound protection token. The plugin trusts the user identifier supplied in the request and does not confirm that the caller owns the account or holds a token tied to that specific user. This pattern matches [CWE-639], where object references are controlled by untrusted input without corresponding access control.
Attack Vector
The attack is fully remote, unauthenticated, and requires no user interaction. An attacker sends a crafted request to the plugin's resend-verification endpoint referencing the victim's user ID or email. The plugin processes the request and marks the victim as unverified. Repeating the request against multiple accounts, including the site administrator, produces a denial-of-service condition affecting authenticated access. Technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-14861
Indicators of Compromise
- Unexpected HTTP POST or GET requests to the plugin's resend-verification endpoint from unauthenticated sessions
- Multiple WordPress users, especially administrators, reporting sudden loss of access and prompts to re-verify their email
- Bursts of outbound verification emails generated without corresponding user activity
- Web server access logs showing enumeration of sequential user IDs against the verification endpoint
Detection Strategies
- Review WordPress access logs for repeated calls to the User Verification plugin's AJAX or REST endpoints tied to resend actions
- Correlate spikes in verification email volume with source IP addresses lacking authenticated sessions
- Alert on state changes to the user_meta fields the plugin uses to track verification status when initiated from unauthenticated contexts
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized analytics platform and baseline normal verification-endpoint traffic
- Monitor administrator account status changes and generate alerts when privileged accounts revert to an unverified state
- Track SMTP send rates from the WordPress host to detect mass verification email generation indicative of exploitation
How to Mitigate CVE-2026-14861
Immediate Actions Required
- Identify all WordPress sites running the User Verification by PickPlugins plugin at version 2.0.47 or earlier
- Deactivate the plugin on affected sites until a fixed version is installed if the verification workflow is not business-critical
- Restrict access to the plugin's resend-verification endpoint at the web application firewall (WAF) or reverse proxy layer
- Audit administrator accounts for unexpected changes to verification status and re-verify legitimate users through an out-of-band channel
Patch Information
At the time of publication, no fixed version is listed in the WPScan Vulnerability Report for versions above 2.0.47. Administrators should monitor the plugin's WordPress.org listing and the vendor's advisory channel for a security release that adds authorization checks and binds verification tokens to individual users.
Workarounds
- Block or rate-limit requests to the plugin's resend-verification endpoint through a WAF rule until a patch is released
- Replace the plugin with an alternative email-verification solution that enforces per-user token binding and authorization checks
- Require administrators to authenticate through a mechanism that does not depend on the plugin's verification state, such as a hardened login flow with multi-factor authentication
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
