Security Optimizer WordPress Plugin Login Bypass

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-13342

Affected Vendors & Products

Vendor	Product	Version / Range
wpsecure	security_optimizer	From 1.5.8 (inc) to 1.6.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The Security Optimizer WordPress plugin versions 1.5.8 to 1.6.4 have a flaw in their IP-based login restriction feature. This flaw allows unauthenticated requests from blocked IP addresses to bypass the restriction and access the login form, effectively disabling the access control set by the administrator.

Impact Analysis

This vulnerability could allow unauthorized users to attempt login access from restricted IP addresses, increasing the risk of brute force attacks or unauthorized access attempts on your WordPress site.

Mitigation Strategies

Update the Security Optimizer WordPress plugin to the latest version beyond 1.6.4 to ensure the IP-based login restriction feature is properly validated.

Hi! I’m here to help you understand CVE-2026-13342. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70