CVE-2026-118185

HighCVSS 7.5

Published: 31/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login. This allows an attacker who already knows a user's password to brute force the second factor and take over the account.

Risk Assessment

An attacker who knows a user's password can guess 2FA codes without restriction and eventually take over the account. This poses a serious threat to account and data security.

Recommendation

Update the Security Optimizer plugin to version 1.6.9 or later. Consider enabling additional login attempt limiting mechanisms.

Other vulnerabilities in Security Optimizer

CVE-2026-13342Medium
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature. This allows the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

Original NVD description (English source)

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS