CVE-2026-119040 · Package
NO FIX YET
The Defender Security WordPress plugin before 6.4.1 does not limit failed two-factor authentication attempts in its default configuration. An attacker who already knows a user's password can guess the one-time code until they get in.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Defender Security WordPress plugin before 6.4.1 that use its two-factor login. The attacker needs a valid username and password first, so sites without two-factor login enabled, or with strong passwords and other login protections, are at lower risk. unknown whether a rate limit exists elsewhere in the stack.
Not affected if plugin-at-6.4.1-or-later, two-factor-disabled
Who cares self-hosted, wordpress, wp-defender
wp plugin get wp-defender --field=versionUnknown from the sources.
The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.