CVE-2025-12374
Published: 05 December 2025
Summary
CVE-2025-12374 is a critical-severity Improper Authentication (CWE-287) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12374 is an authentication bypass vulnerability in the Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress, affecting all versions up to and including 2.0.44. The issue stems from the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function, mapped to CWE-287 (Improper Authentication). Published on 2025-12-05 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it enables critical unauthorized access.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction or privileges required. By submitting an empty OTP value, they can log in as any user with a verified email address, such as an administrator, granting full compromise of confidentiality, integrity, and availability for the targeted account and potentially the entire site.
Advisories and plugin references, including the Wordfence threat intelligence page, WordPress plugin trac code at hook.php line 141, and changeset 3442150, detail the flaw and associated fixes. Mitigation involves updating to a version beyond 2.0.44, where the validation logic is presumably corrected.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201358
Vulnerability details
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not…
more
properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application (T1190) to impersonate any user and compromise the site.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of identified software flaws, directly addressing the authentication bypass by updating the vulnerable WordPress plugin beyond version 2.0.44.
Ensures proper management and verification of OTP authenticators, preventing bypasses from insufficient checks on OTP generation prior to input comparison.
Mandates enforcement of approved authorizations, mitigating unauthorized access enabled by the plugin's flawed OTP validation logic.