# Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Brute Force

- **ID:** WPSEC-2026-0989
- **Plugin:** Security Optimizer – The All-In-One Protection Plugin (`sg-security`), https://wordpress.org/plugins/sg-security/
- **Affected versions:** all versions before 1.6.9
- **Fixed in:** 1.6.9 (Update to 1.6.9 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sg-security
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0989/

## Description

The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8 due to missing rate limiting on the two-factor authentication code and backup code verification step. The plugin's login attempts limit was only applied to the password login form, and failed 2FA code submissions were not counted. This makes it possible for unauthenticated attackers who already know a user's password to brute force the 6-digit authentication code or backup code and log in as that user, bypassing the login restriction configured by the site owner.

## References

- https://wpsec.com/vuln/WPSEC-2026-0989/
- https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/
- https://wordpress.org/plugins/sg-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0989/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.