{"affected":[],"cveId":"CVE-2026-118185","cwes":["CWE-287"],"description":"The Security Optimizer  WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793557030920,"publishedAt":1793427393503,"references":[{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/"}],"remediation":[],"revision":"066fc4dd2f7ca0d8896702bf5bde120416439ad42a3a5192184d95552a028c86","sources":[{"modifiedAt":1793557030920,"name":"NVD","retrievedAt":1793578551819,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118185"}],"ssvc":{"assessedAt":1793554076910,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2026-118185","updatedAt":1793578551819}