# CVE-2026-119040: Defender Security WordPress plugin 2FA bypass via unthrottled OTP

Source: https://junglewise.ai/threats/cve-2026-119040-the-defender-security-wordpress-plugin-before-6-4-1-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-119040 · Severity: info · Published 2026-11-12

The Defender Security WordPress plugin allows attackers to bypass two-factor authentication by brute-forcing the one-time password code without rate limiting. An attacker who has already compromised a user's password can repeatedly guess the 2FA code to gain full account access. This undermines the security benefit of two-factor authentication, putting WordPress sites at risk of account takeover.

Vendors: [WPMU DEV](https://junglewise.ai/threats/vendors/wpmu-dev).

## Quick answers

**Is CVE-2026-119040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119040 being exploited in the wild.

**How severe is CVE-2026-119040?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** WPMU DEV Defender Security before 6.4.1.

**Is there a fix for CVE-2026-119040?** Yes: fixed in 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119040 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119040?** Check whether you run WPMU DEV Defender Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.4.1

## Technical details

The plugin fails to enforce rate limiting or throttling on failed two-factor authentication attempts in its default configuration, allowing brute-force attacks on the one-time code. An attacker with knowledge of a victim's password can exploit this by repeatedly submitting guesses for the OTP to bypass the second authentication factor. The vulnerability is classified as broken authentication (CWE-287) and affects versions before 6.4.1.

## Affected products

- WPMU DEV Defender Security before 6.4.1

## Timeline

- 2026-11-10: disclosed
- 2026-11-12: advisory

## References

- [https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/](https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/)