The User Verification by PickPlugins WordPress plugin up to version 2.0.46 contains an authentication bypass vulnerability. This flaw arises from the use of a loose PHP comparison operator in OTP validation, allowing unauthenticated attackers to log in as any user with a verified email by submitting a 'true' OTP value. The vulnerability has a critical severity rating with a CVSS score of 9.8.