Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Valid Pre-2FA Session
- ID
- WPSEC-2026-0991
- Plugin
- Security Optimizer – The All-In-One Protection Plugin (sg-security)
- Affected
- all versions before 1.6.9
- Remediation
- Update to 1.6.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-613
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Security Optimizer – The All-In-One Protection Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8. The cause is that the session WordPress creates when the password is accepted is not destroyed before the 2FA challenge starts. The plugin's 2FA step runs on the wp_login hook, after WordPress has already created a session and sent valid authentication cookies, and it only expires those cookies with wp_clear_auth_cookie(). The session token stays valid on the server, and the valid cookies are still in the login response. This makes it possible for unauthenticated attackers who know a user's password to take the authentication cookie from the login response and access the account without supplying the second factor.
References
- https://wpsec.com/vuln/WPSEC-2026-0991/
- https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/
- https://wordpress.org/plugins/sg-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS