Description
The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Defender Security | < 6.4.1 | 6.4.1 |
References
- https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/ exploit vdb-entry technical-description