CVE-2026-118185
Received Received - Intake

Brute Force Two-Factor Authentication in Security Optimizer WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: WPScan

Description
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-118185
EUVD
EUVD-2026-114584

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Security Optimizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Security Optimizer WordPress plugin before version 1.6.9 lacks rate limiting for two-factor authentication codes. This allows attackers who know a user's password to repeatedly submit 2FA codes until the correct one is guessed, bypassing authentication and gaining unauthorized account access.

Detection Guidance

Check the installed version of the Security Optimizer WordPress plugin. If it is below 1.6.9, the vulnerability is present. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use the vulnerable plugin version, an attacker could brute force your 2FA code after obtaining your password, leading to full account takeover. This could compromise sensitive data, admin privileges, or other WordPress site functions.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face fines or penalties for failing to protect personal or health information due to inadequate authentication controls.

Mitigation Strategies

Immediately update the Security Optimizer plugin to version 1.6.9 or later. If updating is not possible, disable the plugin or implement additional rate limiting for 2FA code submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart