Is CVE-2026-119040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119040 being exploited in the wild.

How severe is CVE-2026-119040?

Informational severity, published 12 November 2026.

Which products and versions are affected?

WPMU DEV Defender Security before 6.4.1.

Is there a fix for CVE-2026-119040?

Yes: fixed in 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119040 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119040?

Check whether you run WPMU DEV Defender Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119040: Defender Security WordPress plugin 2FA bypass via unthrottled OTP

CVE-2026-119040 · Severity: info · Published 2026-11-12

The Defender Security WordPress plugin allows attackers to bypass two-factor authentication by brute-forcing the one-time password code without rate limiting. An attacker who has already compromised a user's password can repeatedly guess the 2FA code to gain full account access. This undermines the security benefit of two-factor authentication, putting WordPress sites at risk of account takeover.

Vendors: WPMU DEV.

Quick answers

Is CVE-2026-119040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119040 being exploited in the wild.
How severe is CVE-2026-119040?: Informational severity, published 12 November 2026.
Which products and versions are affected?: WPMU DEV Defender Security before 6.4.1.
Is there a fix for CVE-2026-119040?: Yes: fixed in 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119040 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119040?: Check whether you run WPMU DEV Defender Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.4.1

Technical details

The plugin fails to enforce rate limiting or throttling on failed two-factor authentication attempts in its default configuration, allowing brute-force attacks on the one-time code. An attacker with knowledge of a victim's password can exploit this by repeatedly submitting guesses for the OTP to bypass the second authentication factor. The vulnerability is classified as broken authentication (CWE-287) and affects versions before 6.4.1.

Affected products

WPMU DEV Defender Security before 6.4.1

Timeline

2026-11-10: disclosed
2026-11-12: advisory

References

https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.