CVE-2026-118185: Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting

Q: Who is exposed to this issue?

WordPress sites using Security Optimizer versions before 1.6.9 are affected. An attacker must already know a user's password and be able to submit repeated two-factor authentication codes during a pending login.

Q: What does an attacker need to exploit it?

The attacker needs valid credentials for a user account. No user interaction is required, but the attacker must successfully brute-force the second-factor code because failed code submissions are not rate-limited.

Q: How can the issue be remediated?

Update the Security Optimizer WordPress plugin to version 1.6.9 or later. The provided information does not identify an alternative mitigation if updating cannot be performed immediately.

Published Oct 31, 2026

Updated

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Security Optimizer versions before 1.6.9 are affected. An attacker must already know a user's password and be able to submit repeated two-factor authentication codes during a pending login.

What does an attacker need to exploit it?

The attacker needs valid credentials for a user account. No user interaction is required, but the attacker must successfully brute-force the second-factor code because failed code submissions are not rate-limited.

How can the issue be remediated?

Update the Security Optimizer WordPress plugin to version 1.6.9 or later. The provided information does not identify an alternative mitigation if updating cannot be performed immediately.

CVE-2026-118185: Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can the issue be remediated?