WordPress Plugin Vulnerabilities

Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

Description

The plugin does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.

Proof of Concept

Affects Plugins

Plugin icon
defender-security
Fixed in 6.4.1

References

CVE
CVE-2026-119040

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
325f30c7-7ea9-48c8-a7fc-2644779e6ca6

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-10 (about 1 day ago)

Other

Published
Title
Published
2026-09-08
Title
Next-Cart Store to WooCommerce Migration < 3.9.9 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
Published
2024-10-25
Title
Wp Social Login and Register Social Counter < 3.0.8 - Authentication Bypass
Published
2026-03-11
Title
Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass
Published
2019-09-26
Title
GiveWp < 2.5.5 - Authentication Bypass
Published
2026-10-13
Title
LatePoint < 5.7.3 - Subscriber+ Authentication Bypass to Customer Account Takeover via username_exists Fallback