CVE-2026-118185
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Oct 31, 2026
CISA due date
—
The record
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121531 A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. CWE-287
- CVE-2026-120574 The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in… CWE-287
- CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass… CWE-287
- CVE-2026-58915 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD)… CWE-287
- CVE-2026-120447 HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows… CWE-287
- CVE-2026-120278 A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. CWE-287
- CVE-2026-120263 When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and… CWE-287
- CVE-2026-120191 A weakness has been identified in Presenton up to 0.9.11-beta. CWE-287