{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118185","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-10-27T18:33:08.057Z","datePublished":"2026-10-31T06:00:22.549Z","dateUpdated":"2026-10-31T06:00:22.549Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-31T06:00:22.549Z"},"title":"Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting","problemTypes":[{"descriptions":[{"description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"Security Optimizer","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"1.6.9"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Security Optimizer  WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account."}],"references":[{"url":"https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Karthik Ramakrishnan","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}