Hi,
Do you have access to another verification method, such as an alternate email address or an authenticator app?
On the page where it asks for a verification code, click 'Show more verification methods' and send the code to another available method, if any.
If not, on the next page, click I dont have any of these. After clicking that, you will be prompted to complete the information needed to confirm that the account owner is making this sensitive change. Once your account is verified, you will be able to update your security information.
If you have recently made a sensitive security change, your account may be placed in a restricted state for 30 days.
This is done to protect you and alert you in case the security information was changed by someone without your permission. See: https://support.microsoft.com/account-billing/what-does-security-info-change-is-still-pending-mean-cbd0f64f-02d9-45d2-90c3-2375e5a72e52#:~:text=While%20we%20understand%20this%2030,phone%20number%20or%20email%20address