Skip to content
Fencer Intel
no cvss —

CVE-2026-119040 json

Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

published 3h ago modified 3h ago also EUVD-2026-124276

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.

Patch / fix

  • Unknown Defender Security 6.4.1

Is CVE-2026-119040 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown Defender Security

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.