CVE-2026-118185— Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
Quick assessment
Affected
Unknown Security Optimizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Security Optimizer 插件在 WordPress 平台上的 1.6.9 版本之前，未对等待登录时提交的双因素认证（2FA）验证码数量进行限制。这使得已知用户密码的攻击者能够暴力破解第二重认证因素，从而接管该账户。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118185
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
Source: CVE Program / CVE List V5
Vulnerability Description
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Security Optimizer | 0 ~ 1.6.9 | - |
|
II. Public POCs for CVE-2026-118185
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118185
请登录查看更多情报信息。
Other References for CVE-2026-118185 (1)
-
https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback | |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure | |
| CVE-2026-118438 | Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute | |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE | |
| CVE-2026-118437 | BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion | |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure vi | |
| CVE-2026-118184 | Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation | |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal | |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u | |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-118438
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Im -
CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Mod -
CVE-2026-118437
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment