# CVE-2026-118185: Security Optimizer 2FA bypass via missing rate limiting

Source: https://junglewise.ai/threats/cve-2026-118185-the-security-optimizer-wordpress-plugin-before-1-6-9-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-118185 · Severity: info · Published 2026-10-31

The Security Optimizer WordPress plugin provides two-factor authentication (2FA) to protect WordPress accounts from unauthorized access. Before version 1.6.9, the plugin failed to limit repeated authentication code submissions, allowing an attacker who has obtained a user's password to guess the 2FA code through brute force and take over the account.

Vendors: [WPScan](https://junglewise.ai/threats/vendors/wpscan).

## Quick answers

**Is CVE-2026-118185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118185 being exploited in the wild.

**How severe is CVE-2026-118185?** Informational severity, published 31 October 2026.

**Which products and versions are affected?** WPScan Security Optimizer before 1.6.9.

**Is there a fix for CVE-2026-118185?** Yes: fixed in 1.6.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118185 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-118185?** Check whether you run WPScan Security Optimizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.9

## Technical details

The plugin lacks rate limiting on 2FA code submission attempts during account login. An attacker with knowledge of a valid username and password can repeatedly submit different 2FA codes without throttling, enabling a brute-force attack on the second authentication factor. This is a broken authentication vulnerability (CWE-287) that can be exploited over the network from outside the organization.

## Affected products

- WPScan Security Optimizer before 1.6.9

## Timeline

- 2026-10-31: disclosed
- 2026-10-29: advisory

## References

- [https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/](https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/)