# Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass for Multisite Super Administrators

- **ID:** WPSEC-2026-0990
- **Plugin:** Security Optimizer – The All-In-One Protection Plugin (`sg-security`), https://wordpress.org/plugins/sg-security/
- **Affected versions:** all versions before 1.6.9
- **Fixed in:** 1.6.9 (Update to 1.6.9 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sg-security
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0990/

## Description

The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8 due to the 2FA requirement being determined only from the user's roles on the current site. On multisite installations, Super Administrators who have no role on the site they log in through were treated as out of 2FA scope, so the second factor was never requested. This makes it possible for unauthenticated attackers who have obtained a Super Administrator's password to log in without providing the second factor.

## References

- https://wpsec.com/vuln/WPSEC-2026-0990/
- https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/
- https://wordpress.org/plugins/sg-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0990/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.