{"affected":[{"defaultStatus":"unaffected","product":"Defender Security","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-119040","cwes":["CWE-287"],"description":"The Defender Security  WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/"}],"kev":null,"metrics":[],"modifiedAt":1794463207503,"publishedAt":1794463207503,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/"}],"remediation":[],"revision":"d3c09c629d42f2a7d54034ff7a36b7d0deacfc676fff7dc83bbf371e917b80ba","sources":[{"modifiedAt":1794463207503,"name":"CNA: WPScan","retrievedAt":1794467312007,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119040"}],"ssvc":null,"status":"published","title":"Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification","updatedAt":1794467312007}