CVE-2026-119040
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 12, 2026
Vendor
unknown
Description
The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.