Weakness in Two-Factor Authentication in Defender Security Plugin for WordPress
CVE-2026-119040
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-119040?
The Defender Security WordPress plugin, prior to version 6.4.1, has a significant flaw in its two-factor authentication process. This vulnerability permits attackers, who may already possess a victim's password, to execute brute-force attacks against the one-time authentication codes. Without adequate limitations on failed authentication attempts, the plugin fails to protect users sufficiently, compromising the integrity of the second authentication factor.
Affected Version(s)
Defender Security 0 < 6.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.