User Verification by PickPlugins <= 2.0.45 - Missing Authorization

This research plan targets CVE-2026-32497, a Missing Authorization vulnerability in the User Verification by PickPlugins plugin (versions <= 2.0.45). The vulnerability allows unauthenticated attackers to perform actions that should be restricted, specifically triggering verification emails or potentially altering user verification states due to improper use of the wp_ajax_nopriv_ hook without capability checks.

---

1. Vulnerability Summary

The User Verification plugin registers several AJAX handlers for both logged-in (wp_ajax_) and guest (wp_ajax_nopriv_) users. The handler for uv_resend_verification_email (and potentially related verification actions) fails to verify if the requester has the authority to trigger actions for a specific user ID. While a nonce might be present, it is often exposed to unauthenticated users via localized scripts on the frontend registration/login pages, making it a "public" nonce.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: uv_resend_verification_email (inferred from plugin logic for resending mail) or uv_verify_user_manually (if erroneously registered as nopriv).
• Vulnerable Parameter: user_id or user_email.
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active. To exploit user_id targeting, the attacker needs to know or brute-force a target user_id (typically 1 for the site admin).

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php with action=uv_resend_verification_email.
2. Hook Registration: The plugin registers the action in includes/class-user-verification-ajax.php (or similar):

   add_action('wp_ajax_uv_resend_verification_email', array($this, 'uv_resend_verification_email'));
   add_action('wp_ajax_nopriv_uv_resend_verification_email', array($this, 'uv_resend_verification_email'));
   

3. Vulnerable Handler: The function uv_resend_verification_email() is called.
4. Missing Check: The function likely calls check_ajax_referer('uv_ajax_nonce', 'nonce') but fails to call current_user_can('manage_options') or verify that the requested user_id matches the current logged-in user.
5. Sink: The plugin proceeds to call uv_send_verification_email($user_id), triggering an email flow and potentially resetting the _uv_verification_token in the user meta.

4. Nonce Acquisition Strategy

The plugin enqueues a script and localizes a nonce for AJAX operations.

• Script Handle: user-verification-public (or similar).
• Localization Object: uv_ajax_obj.
• Nonce Key: nonce.
• Trigger Shortcode: [user_verification_login] or [user_verification_registration].

Steps to acquire:

1. Create a page containing the login shortcode:
   wp post create --post_type=page --post_status=publish --post_title="UV-Gate" --post_content='[user_verification_login]'
2. Navigate to the page using browser_navigate.
3. Extract the nonce:
   browser_eval("window.uv_ajax_obj?.nonce")

5. Exploitation Strategy

We will attempt to trigger a verification email for the Admin user (ID 1), which forces a state change (new token generation) in the database for that user.

• Target URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Payload:

  action=uv_resend_verification_email&user_id=1&nonce=<EXTRACTED_NONCE>
  

• Alternative Payload (if by email):

  action=uv_resend_verification_email&user_email=admin@example.com&nonce=<EXTRACTED_NONCE>
  

6. Test Data Setup

1. Install Plugin: Ensure user-verification version 2.0.45 is installed.
2. Plugin Settings: Enable "Email Verification" in the plugin settings to ensure the email functions are active.
3. Target User: Use the default admin account (ID 1).
4. Nonce Page: Create the page as described in Section 4.

7. Expected Results

• Response: The server should return a JSON response, likely {"success": true, "data": "..."} or a message indicating the email was resent.
• Side Effect: The user meta _uv_verification_token for user ID 1 should be updated or created in the database.

8. Verification Steps

1. Database Check: Before and after the exploit, check the user meta for the target user:
   wp usermeta get 1 _uv_verification_token
   If the value changes after the unauthenticated request, the authorization bypass is confirmed.
2. Log Check: Check if an email was queued (if a mail logging plugin is installed):
   wp eval "print_r(get_option('uv_sent_emails_log'));" (hypothetical log location).

9. Alternative Approaches

If uv_resend_verification_email is properly protected, check for these alternative unauthenticated AJAX actions:

1. uv_ajax_check_email_exists: This can be used for user enumeration/lookup without authorization.
2. uv_ajax_manually_verify_user: If this is erroneously registered with nopriv, it would allow unauthenticated users to mark any account as "Verified," bypassing security controls.
   • Payload: action=uv_verify_user_manually&user_id=1&nonce=<NONCE>

If uv_ajax_obj is not found, search for any script localized data containing "nonce" by inspecting the page source:
browser_eval("JSON.stringify(window)") and search for keys starting with uv_.