WordPress Plugin Vulnerabilities

Security Optimizer < 1.6.7 - 2FA Bypass

Description

The plugin is vulnerable to 2FA Bypass. This makes it possible for unauthenticated attackers to bypass a second factor of authentication when the first is known.

Affects Plugins

Plugin icon
sg-security
Fixed in 1.6.7

References

CVE
CVE-2026-82228
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce8f128-78c6-4118-a178-0c163c55b07d

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
d71ec58d-2b09-4d07-a6b7-7dea34eb2926

Timeline

Publicly Published
2026-08-28 (about 1 month ago)
Added
2026-09-02 (about 1 month ago)
Last Updated
2026-09-02 (about 1 month ago)

Other

Published
Title
Published
2026-04-09
Title
Customer Reviews for WooCommerce < 5.104.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
Published
2026-08-29
Title
SAML Single Sign On < 5.4.7 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
Published
2025-06-02
Title
Golo < 1.7.1 - Authentication Bypass to Account Takeover
Published
2020-03-31
Title
Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
Published
2026-09-03
Title
RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation