Threats tagged 'ghsa-gmxr-g9qg-qjhg'

The User Verification by PickPlugins WordPress plugin versions before 2.0.49 lacks rate limiting on the verification step of its one-time-password login and does not expire generated codes. This allows unauthenticated attackers to brute force verification codes and gain unauthorized access to any user account, including administrators, when the code is configured to use digits only.