CVE-2026-118185 — Vulnerability intelligence
— Security Optimizer
Published:
- CVSS
- 7.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.