{
 "id": "WPSEC-2026-0989",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0989/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0989/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0989/index.md",
 "title": "Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Brute Force",
 "description": "The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8 due to missing rate limiting on the two-factor authentication code and backup code verification step. The plugin's login attempts limit was only applied to the password login form, and failed 2FA code submissions were not counted. This makes it possible for unauthenticated attackers who already know a user's password to brute force the 6-digit authentication code or backup code and log in as that user, bypassing the login restriction configured by the site owner.",
 "plugin": {
  "slug": "sg-security",
  "name": "Security Optimizer – The All-In-One Protection Plugin",
  "full_name": "Security Optimizer – The All-In-One Protection Plugin",
  "wordpress_org": "https://wordpress.org/plugins/sg-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sg-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sg-security"
 },
 "type": "AUTH",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.9",
 "remediation": "Update to 1.6.9 or later.",
 "fix_released": "2026-10-14T08:44:18+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:15:54.118091+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0989/",
  "https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/",
  "https://wordpress.org/plugins/sg-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sg-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}