{"id":"CVE-2026-119040","kind":"vulnerability","aliases":["CVE-2026-119040"],"related":[],"title":"Defender Security WordPress plugin: two-factor login can be brute-forced","description":"The Defender Security  WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.","summary":"The Defender Security WordPress plugin before 6.4.1 does not limit failed two-factor authentication attempts in its default configuration. An attacker who already knows a user's password can guess the one-time code until they get in.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-defender"],"not_affected_if":["plugin-at-6.4.1-or-later","two-factor-disabled"],"how_to_check":"- Check the installed Defender Security version in the WordPress plugin list or with `wp plugin get wp-defender --field=version`\n- Confirm whether two-factor login is enabled in the plugin's settings","fix":null,"status":"open","published_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:37:59+00:00","updated_at":"2026-11-12T06:37:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:59Z","model":"claude-haiku-5-5","output":{"fix":"- Defender Security `6.4.1` or later, per the NVD description (\"before 6.4.1\")","reach":"internet","title":"Defender Security WordPress plugin: two-factor login can be brute-forced","impact":"medium","summary":"The Defender Security WordPress plugin before 6.4.1 does not limit failed two-factor authentication attempts in its default configuration. An attacker who already knows a user's password can guess the one-time code until they get in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-defender","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker defeats second factor and logs into the account","analyst_note":"Product data is not given; confirm the affected version range and the fixed release from the NVD entry or the plugin changelog.","how_to_check":"- Check the installed Defender Security version in the WordPress plugin list or with `wp plugin get wp-defender --field=version`\n- Confirm whether two-factor login is enabled in the plugin's settings","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-6.4.1-or-later","two-factor-disabled"],"who_is_affected":"Sites running the Defender Security WordPress plugin before 6.4.1 that use its two-factor login. The attacker needs a valid username and password first, so sites without two-factor login enabled, or with strong passwords and other login protections, are at lower risk. unknown whether a rate limit exists elsewhere in the stack.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4532,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119040':16A,19A '-2026':15A,18A '6.4.1':34B,73C 'allow':90C 'alreadi':51B,94C 'attack':49B,92C 'attempt':43B,85C 'authent':42B,84C,113C 'brute':12A,102C 'brute-forc':11A,101C 'code':63B,108C 'configur':47B,89C 'cve':14A,17A 'default':46B,88C 'defeat':110C 'defend':1A,27B,29B,68C 'factor':7A,41B,83C,114C 'fail':38B,80C 'forc':13A,103C 'get':66B 'guess':58B 'host':23B 'know':52B,95C 'limit':37B,76C 'login':8A 'number':78C 'one':61B,106C 'one-tim':60B,105C 'packag':20B 'password':56B,99C 'plugin':4A,32B,71C 'second':112C 'secur':2A,30B,69C 'self':22B 'self-host':21B 'time':62B,107C 'two':6A,40B,82C 'two-factor':5A,39B,81C 'user':54B 'victim':97C 'wordpress':3A,24B,31B,70C 'wp':26B 'wp-defend':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Defender Security WordPress plugin before 6.4.1 that use its two-factor login. The attacker needs a valid username and password first, so sites without two-factor login enabled, or with strong passwords and other login protections, are at lower risk. unknown whether a rate limit exists elsewhere in the stack.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpdefender"],"campaign_type":null,"search_a":"'-119040':16A,19A '-2026':15A,18A 'brute':12A 'brute-forc':11A 'cve':14A,17A 'defend':1A 'factor':7A 'forc':13A 'login':8A 'plugin':4A 'secur':2A 'two':6A 'two-factor':5A 'wordpress':3A","search_b":"'6.4.1':34B 'alreadi':51B 'attack':49B 'attempt':43B 'authent':42B 'code':63B 'configur':47B 'default':46B 'defend':27B,29B 'factor':41B 'fail':38B 'get':66B 'guess':58B 'host':23B 'know':52B 'limit':37B 'one':61B 'one-tim':60B 'packag':20B 'password':56B 'plugin':32B 'secur':30B 'self':22B 'self-host':21B 'time':62B 'two':40B 'two-factor':39B 'user':54B 'wordpress':24B,31B 'wp':26B 'wp-defend':25B","search_c":"'6.4.1':73C 'allow':90C 'alreadi':94C 'attack':92C 'attempt':85C 'authent':84C,113C 'brute':102C 'brute-forc':101C 'code':108C 'configur':89C 'default':88C 'defeat':110C 'defend':68C 'factor':83C,114C 'fail':80C 'forc':103C 'know':95C 'limit':76C 'number':78C 'one':106C 'one-tim':105C 'password':99C 'plugin':71C 'second':112C 'secur':69C 'time':107C 'two':82C 'two-factor':81C 'victim':97C 'wordpress':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119040","severity":null,"published_at":"2026-11-12T06:17:12+00:00","modified_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}