# Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Valid Pre-2FA Session

- **ID:** WPSEC-2026-0991
- **Plugin:** Security Optimizer – The All-In-One Protection Plugin (`sg-security`), https://wordpress.org/plugins/sg-security/
- **Affected versions:** all versions before 1.6.9
- **Fixed in:** 1.6.9 (Update to 1.6.9 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-613
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sg-security
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0991/

## Description

The Security Optimizer plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.6.8. The cause is that the session WordPress creates when the password is accepted is not destroyed before the 2FA challenge starts. The plugin's 2FA step runs on the wp_login hook, after WordPress has already created a session and sent valid authentication cookies, and it only expires those cookies with wp_clear_auth_cookie(). The session token stays valid on the server, and the valid cookies are still in the login response. This makes it possible for unauthenticated attackers who know a user's password to take the authentication cookie from the login response and access the account without supplying the second factor.

## References

- https://wpsec.com/vuln/WPSEC-2026-0991/
- https://plugins.svn.wordpress.org/sg-security/tags/1.6.9/
- https://wordpress.org/plugins/sg-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0991/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.