{"id":"CVE-2026-118185","kind":"vulnerability","aliases":["CVE-2026-118185"],"related":[],"title":"Security Optimizer WordPress plugin: unlimited two-factor code guesses allow account takeover","description":"The Security Optimizer  WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.","summary":"The Security Optimizer WordPress plugin before 1.6.9 does not limit how many two-factor authentication codes can be submitted for a pending login. An attacker who already knows a user's password can brute force the second factor and take over the account.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-version-1.6.9-or-later","two-factor-not-enabled"],"how_to_check":"- Check the installed Security Optimizer plugin version in the WordPress admin Plugins page; versions before `1.6.9` are affected.\n- Confirm whether two-factor authentication is enabled through the plugin for your users.","fix":null,"status":"open","published_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:27+00:00","updated_at":"2026-10-31T06:34:27+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-31T06:34:27Z","model":"claude-haiku-5-5","output":{"fix":"- Security Optimizer plugin: `1.6.9` or later","reach":"internet","title":"Security Optimizer WordPress plugin: unlimited two-factor code guesses allow account takeover","impact":"high","summary":"The Security Optimizer WordPress plugin before 1.6.9 does not limit how many two-factor authentication codes can be submitted for a pending login. An attacker who already knows a user's password can brute force the second factor and take over the account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over a WordPress account after brute forcing the second factor","analyst_note":"","how_to_check":"- Check the installed Security Optimizer plugin version in the WordPress admin Plugins page; versions before `1.6.9` are affected.\n- Confirm whether two-factor authentication is enabled through the plugin for your users.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-1.6.9-or-later","two-factor-not-enabled"],"who_is_affected":"Sites running the Security Optimizer WordPress plugin before version 1.6.9 that use its two-factor login feature. An attacker must already know a user's password, so sites without two-factor enabled through this plugin are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4101,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118185':16A,19A '-2026':15A,18A '1.6.9':34B,78C 'account':12A,71B,118C 'allow':11A,98C 'alreadi':55B,102C 'attack':53B,100C 'authent':43B,88C 'brute':62B,109C 'code':9A,44B,89C 'cve':14A,17A 'factor':8A,42B,66B,87C,113C 'forc':63B,110C 'guess':10A 'host':23B 'know':56B,103C 'limit':37B,81C 'login':51B,97C 'mani':39B 'number':83C 'optim':2A,30B,74C 'password':60B,107C 'pend':50B,96C 'plugin':4A,27B,32B,76C 'second':65B,112C 'secur':1A,29B,73C 'self':22B 'self-host':21B 'submit':47B,93C 'take':68B,115C 'takeov':13A 'two':7A,41B,86C 'two-factor':6A,40B,85C 'unlimit':5A 'user':58B,105C 'wordpress':3A,24B,26B,31B,75C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security Optimizer WordPress plugin before version 1.6.9 that use its two-factor login feature. An attacker must already know a user's password, so sites without two-factor enabled through this plugin are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118185","severity":null,"published_at":"2026-10-31T06:16:33+00:00","modified_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}