CVE-2022-4693: User Verification < 1.0.94 - Authentication Bypass
Vulnerability summary
CVE-2022-4693 is a critical (CVSS 9.8) Insufficiently Protected Credentials vulnerability in pickplugins user_verification. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.5% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 1.0.94.
Timeline
- 23-01-2023PublishedVulnerability first disclosed.
- 02-04-2025Last modifiedVulnerability information updated.
Description
The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.60%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.60% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (lana.codes)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Pickplugins1 product
- user_verification< 1.0.94
Unknown1 product
- user verification< 1.0.94
Wordpress1 product
- user-verification≤ 1.0.93 (fixed in 1.0.94)
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/1eee10a8-135f-4b76-8289-c381ff1f51eaExploitVDB EntryTechnical DescriptionThird Party Advisory