{
 "id": "WPSEC-2026-0991",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0991/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0991/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0991/index.md",
 "title": "Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Valid Pre-2FA Session",
 "description": "The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8. The cause is that the session WordPress creates when the password is accepted is not destroyed before the 2FA challenge starts. The plugin's 2FA step runs on the wp_login hook, after WordPress has already created a session and sent valid authentication cookies, and it only expires those cookies with wp_clear_auth_cookie(). The session token stays valid on the server, and the valid cookies are still in the login response. This makes it possible for unauthenticated attackers who know a user's password to take the authentication cookie from the login response and access the account without supplying the second factor.",
 "plugin": {
  "slug": "sg-security",
  "name": "Security Optimizer – The All-In-One Protection Plugin",
  "full_name": "Security Optimizer – The All-In-One Protection Plugin",
  "wordpress_org": "https://wordpress.org/plugins/sg-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sg-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sg-security"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-613"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.9",
 "remediation": "Update to 1.6.9 or later.",
 "fix_released": "2026-10-14T08:44:18+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:15:54.118091+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0991/",
  "https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/",
  "https://wordpress.org/plugins/sg-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sg-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}