CVE-2026-14861 — User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor…
Published: 2026-08-19 · CVSS: 7.5 · CVSS 3.1
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7