Vulnerabilities / Security Optimizer – The All-In-One Protection Plugin / WPSEC-2026-0989
Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Brute Force
High 8.1
CWE-307Fixed in 1.6.9
- ID
- WPSEC-2026-0989
- Plugin
- Security Optimizer – The All-In-One Protection Plugin (sg-security)
- Affected
- all versions before 1.6.9
- Remediation
- Update to 1.6.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Security Optimizer – The All-In-One Protection Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8 due to missing rate limiting on the two-factor authentication code and backup code verification step. The plugin's login attempts limit was only applied to the password login form, and failed 2FA code submissions were not counted. This makes it possible for unauthenticated attackers who already know a user's password to brute force the 6-digit authentication code or backup code and log in as that user, bypassing the login restriction configured by the site owner.
References
- https://wpsec.com/vuln/WPSEC-2026-0989/
- https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/
- https://wordpress.org/plugins/sg-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS