Security Optimizer CVE-2026-118185

Exploitation requires that the attacker ALREADY possesses the target user's valid WordPress password, and that the account has two-factor authentication enabled through the Security Optimizer (formerly SG Security) plugin running a version before 1.6.9. The specific flaw is the absence of any limit on the number of 2FA codes submitted for a single pending login, which makes brute-forcing the second factor feasible. Limiting factors that reduce real-world risk: it is not exploitable from zero knowledge - prior credential compromise is a hard prerequisite; it only matters where 2FA is actually enabled by this plugin; and it is bounded to the vulnerable version range (<1.6.9), with a vendor patch available.

The signals point to a real but conditional, non-urgent issue rather than a mass-exploitation emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects network reach and total CIA impact (account takeover) but high attack complexity and a required privilege/precondition - consistent with the description's core gate: the attacker must ALREADY know the victim's password before brute-forcing the second factor. EPSS is low (0.18%, 8th percentile) and SSVC records Exploitation: none and Automatable: no, which agree with each other and reinforce that this is not seen being exploited and is not readily scriptable at scale; the one countervailing signal is SSVC Technical Impact: total, matching the C:H/I:H/A:H full-account-compromise outcome. There is no CISA KEV listing and no confirmed public exploit in the input, so this is high-impact-if-reached but not currently a widespread-exploitation priority. The vuln.today decision label is 'this_week', indicating patch within the normal near-term cycle rather than emergency. One tension worth noting: the official vector marks PR:L, but the real prerequisite is possession of the victim's password (stolen/phished credentials), not a system-granted privilege of the attacker - verify how the precondition is being modeled when prioritizing.

An attacker who has already obtained a user's WordPress password (via phishing, reuse, or a prior breach) reaches the login flow that is awaiting the second factor and, because the plugin before 1.6.9 does not cap the number of 2FA code submissions, automates guessing until the correct code is accepted. Success yields full takeover of that account, up to administrator if the targeted user is privileged. No public exploit was identified in the provided data.