Live › vulnerability › CVE-2026-118185
The Security Optimizer WordPress plugin before 1.6.9 does not limit how many two-factor authentication codes can be submitted for a pending login. An attacker who already knows a user's password can brute force the second factor and take over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Security Optimizer WordPress plugin before version 1.6.9 that use its two-factor login feature. An attacker must already know a user's password, so sites without two-factor enabled through this plugin are less exposed.
No product ranges from the sources yet.
1.6.9 are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-118185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.