CVE-2026-119040: Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

Q: Who is exposed to this issue?

Sites using Defender Security versions before 6.4.1 are exposed in the plugin's default configuration, particularly accounts protected by its two-factor authentication flow.

Q: What does an attacker need to exploit it?

The attacker must already know the victim's password. They can then make unlimited guesses for the one-time 2FA code until they successfully bypass the second factor.

Q: Is the default configuration affected?

Yes. The plugin does not limit failed two-factor authentication attempts in its default configuration.

Published Nov 12, 2026

Updated

The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Defender Security WordPress plugin to a version that resolves this vulnerability.
Fixed in 6.4.1

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using Defender Security versions before 6.4.1 are exposed in the plugin's default configuration, particularly accounts protected by its two-factor authentication flow.

What does an attacker need to exploit it?

The attacker must already know the victim's password. They can then make unlimited guesses for the one-time 2FA code until they successfully bypass the second factor.

Is the default configuration affected?

Yes. The plugin does not limit failed two-factor authentication attempts in its default configuration.

CVE-2026-119040: Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration affected?