CVE-2026-118185

{"id": "CVE-2026-118185", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Security Optimizer", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.9", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-31T06:16:33.503", "references": [{"url": "https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/", "source": "contact@wpscan.com"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account."}], "lastModified": "2026-10-31T06:16:33.503", "sourceIdentifier": "contact@wpscan.com"}